@oneuptime/common 14.0.8 → 14.0.10

package/build/dist/Server/Utils/AI/SRE/InvestigationEligibility.js

@@ -25,8 +25,8 @@ export default class InvestigationEligibility {
                     ? `AI was disabled for this project when this ${kind} was created, so its automatic investigation did not start.`
                     : "AI is currently disabled for this project, so new automatic investigations cannot start.",
                 nextStep: recorded
-                    ? "Review project AI settings for new records. Existing records are not automatically retried when AI is enabled."
-                    : "Enable project AI and automatic investigations to investigate new records. Existing records are not automatically retried.",
+                    ? "Review project AI settings (Project Settings → AI Features) for new records. Existing records are not automatically retried when AI is enabled."
+                    : "Turn on Enable AI (Project Settings → AI Features) and automatic investigations to investigate new records. Existing records are not automatically retried.",
             },
             automatic_investigation_disabled: {
                 title: recorded
@@ -48,6 +48,17 @@ export default class InvestigationEligibility {
                     ? "Review the AI provider configuration for new investigations. Configuring a provider later does not automatically retry existing records."
                     : "Configure an AI provider in project settings. New eligible records can then be investigated; existing records are not automatically retried.",
             },
+            insufficient_ai_balance: {
+                title: recorded
+                    ? "The project was out of AI credits at creation"
+                    : "The project is currently out of AI credits",
+                description: recorded
+                    ? `This project had no AI credits left when this ${kind} was created, so its automatic investigation did not start.`
+                    : "This project is currently out of AI credits, so new automatic investigations cannot start.",
+                nextStep: recorded
+                    ? "Review AI credits under Project Settings → AI Credits, or turn on auto-recharge. Adding credits later does not retry this record."
+                    : "Add AI credits under Project Settings → AI Credits, or turn on auto-recharge. Existing records are not automatically retried.",
+            },
             severity_below_threshold: {
                 title: recorded
                     ? "Severity was below the investigation threshold at creation"

package/build/dist/Server/Utils/AI/SRE/InvestigationEligibility.js.map

@@ -1 +1 @@
-{"version":3,"file":"InvestigationEligibility.js","sourceRoot":"","sources":["../../../../../../Server/Utils/AI/SRE/InvestigationEligibility.ts"],"names":[],"mappings":"AAOA,OAAO,SAAqC,MAAM,6BAA6B,CAAC;AAChF,OAAO,YAAY,MAAM,gCAAgC,CAAC;AAC1D,OAAO,eAAe,MAAM,mCAAmC,CAAC;AAChE,OAAO,MAAM,MAAM,cAAc,CAAC;AAClC,OAAO,qBAAqB,MAAM,yBAAyB,CAAC;AAC5D,OAAO,0BAA0B,MAAM,4BAA4B,CAAC;AACpE,OAAO,6BAA6B,MAAM,+BAA+B,CAAC;AAQ1E,MAAM,CAAC,OAAO,OAAO,wBAAwB;IACpC,MAAM,CAAC,MAAM,CAClB,IAAiC,EACjC,OAA6B,EAC7B,MAA+B,EAC/B,OAAkC;QAElC,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;IAEO,MAAM,CAAC,WAAW,CACxB,MAA4C,EAC5C,IAAiC,EACjC,OAA6B,EAC7B,MAA+B,EAC/B,OAAkC;;QAElC,MAAM,IAAI,GAAW,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QAC5D,MAAM,QAAQ,GAAY,MAAM,KAAK,UAAU,CAAC;QAChD,MAAM,cAAc,GAClB,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,qBAAqB,MAAK,SAAS;YAC1C,CAAC,CAAC,GAAG,OAAO,CAAC,qBAAqB,SAAS;YAC3C,CAAC,CAAC,YAAY,CAAC;QACnB,MAAM,OAAO,GAGT;YACF,WAAW,EAAE;gBACX,KAAK,EAAE,QAAQ;oBACb,CAAC,CAAC,uCAAuC;oBACzC,CAAC,CAAC,oCAAoC;gBACxC,WAAW,EAAE,QAAQ;oBACnB,CAAC,CAAC,8CAA8C,IAAI,6DAA6D;oBACjH,CAAC,CAAC,0FAA0F;gBAC9F,QAAQ,EAAE,QAAQ;oBAChB,CAAC,CAAC,gHAAgH;oBAClH,CAAC,CAAC,4HAA4H;aACjI;YACD,gCAAgC,EAAE;gBAChC,KAAK,EAAE,QAAQ;oBACb,CAAC,CAAC,aAAa,IAAI,oCAAoC;oBACvD,CAAC,CAAC,aAAa,IAAI,wCAAwC;gBAC7D,WAAW,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,+CAA+C,IAAI,eAAe,IAAI,eAAe,CAAC,CAAC,CAAC,wDAAwD,IAAI,IAAI,6DAA6D;gBAChP,QAAQ,EAAE,QAAQ;oBAChB,CAAC,CAAC,oBAAoB,IAAI,mCAAmC,IAAI,qEAAqE,IAAI,GAAG;oBAC7I,CAAC,CAAC,oBAAoB,IAAI,0BAA0B,IAAI,oDAAoD;aAC/G;YACD,gBAAgB,EAAE;gBAChB,KAAK,EAAE,QAAQ;oBACb,CAAC,CAAC,0CAA0C;oBAC5C,CAAC,CAAC,uCAAuC;gBAC3C,WAAW,EAAE,QAAQ;oBACnB,CAAC,CAAC,iDAAiD,IAAI,sEAAsE;oBAC7H,CAAC,CAAC,mIAAmI;gBACvI,QAAQ,EAAE,QAAQ;oBAChB,CAAC,CAAC,0IAA0I;oBAC5I,CAAC,CAAC,8IAA8I;aACnJ;YACD,wBAAwB,EAAE;gBACxB,KAAK,EAAE,QAAQ;oBACb,CAAC,CAAC,4DAA4D;oBAC9D,CAAC,CAAC,uDAAuD;gBAC3D,WAAW,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,aAAa,IAAI,mBAAmB,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,GAAG,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,YAAY,EAAC,CAAC,CAAC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,eAAe,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,mBAAmB,EAAC,CAAC,CAAC,eAAe,OAAO,CAAC,mBAAmB,yBAAyB,CAAC,CAAC,CAAC,wCAAwC,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,0EAA0E,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC7b,QAAQ,EACN,sHAAsH;aACzH;YACD,gBAAgB,EAAE;gBAChB,KAAK,EAAE,QAAQ;oBACb,CAAC,CAAC,qCAAqC;oBACvC,CAAC,CAAC,0DAA0D;gBAC9D,WAAW,EAAE,QAAQ;oBACnB,CAAC,CAAC,WAAW,IAAI,mFAAmF,cAAc,+CAA+C,IAAI,uCAAuC;oBAC5M,CAAC,CAAC,qFAAqF,cAAc,sDAAsD,IAAI,2BAA2B;gBAC5L,QAAQ,EACN,+KAA+K;aAClL;YACD,sBAAsB,EAAE;gBACtB,KAAK,EACH,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,aAAa,MAAK,CAAC;oBACzB,CAAC,CAAC,QAAQ;wBACR,CAAC,CAAC,uDAAuD;wBACzD,CAAC,CAAC,gEAAgE;oBACpE,CAAC,CAAC,QAAQ;wBACR,CAAC,CAAC,wCAAwC;wBAC1C,CAAC,CAAC,8CAA8C;gBACtD,WAAW,EAAE,MAAM;oBACjB,CAAC,CAAC,eAAe,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC,eAAe,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,MAAA,MAAM,CAAC,aAAa,0CAAE,cAAc,CAAC,OAAO,CAAC,0BAA0B,QAAQ,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC,mEAAmE,EAAE;oBAC3U,CAAC,CAAC,4CAA4C,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,gFAAgF,CAAC,CAAC,CAAC,6DAA6D,EAAE;gBACtN,QAAQ,EACN,2IAA2I;aAC9I;YACD,mBAAmB,EAAE;gBACnB,KAAK,EAAE,QAAQ;oBACb,CAAC,CAAC,oCAAoC;oBACtC,CAAC,CAAC,yCAAyC;gBAC7C,WAAW,EAAE,QAAQ;oBACnB,CAAC,CAAC,0IAA0I;oBAC5I,CAAC,CAAC,mHAAmH;gBACvH,QAAQ,EACN,sHAAsH;aACzH;YACD,cAAc,EAAE;gBACd,KAAK,EAAE,QAAQ;oBACb,CAAC,CAAC,uCAAuC;oBACzC,CAAC,CAAC,wDAAwD;gBAC5D,WAAW,EAAE,QAAQ;oBACnB,CAAC,CAAC,uGAAuG;oBACzG,CAAC,CAAC,gGAAgG;gBACpG,QAAQ,EACN,sHAAsH;aACzH;YACD,wBAAwB,EAAE;gBACxB,KAAK,EAAE,QAAQ;oBACb,CAAC,CAAC,iDAAiD;oBACnD,CAAC,CAAC,sDAAsD;gBAC1D,WAAW,EAAE,QAAQ;oBACnB,CAAC,CAAC,wFAAwF;oBAC1F,CAAC,CAAC,yFAAyF;gBAC7F,QAAQ,EACN,uHAAuH;aAC1H;YACD,eAAe,EAAE;gBACf,KAAK,EAAE,+BAA+B;gBACtC,WAAW,EAAE,QAAQ,IAAI,6OAA6O;gBACtQ,QAAQ,EACN,iOAAiO;aACpO;SACF,CAAC;QACF,qCACE,IAAI,IACD,OAAO,CAAC,IAAI,CAAC,KAChB,WAAW,EAAE,QAAQ;gBACnB,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW;gBAC3B,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,4IAA4I,EAC5K,MAAM,EACN,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IACrC;IACJ,CAAC;IAED,8EAA8E;IACvE,MAAM,CAAC,KAAK,CAAC,aAAa,CAC/B,OAA6B,EAC7B,IAAiC,EACjC,MAA+B,EAC/B,OAAkC;QAElC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAkC,IAAI,CAAC,MAAM,CACzD,IAAI,EACJ,OAAO,EACP,MAAM,EACN,OAAO,CACR,CAAC;YACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,YAAY,CAAC,6BAA6B,CAAC;oBAC/C,EAAE,EAAE,OAAO,CAAC,OAAO;oBACnB,IAAI,EAAE,EAAE,uBAAuB,EAAE,QAAQ,EAAE;oBAC3C,YAAY,EAAE;wBACZ,SAAS,EAAE,OAAO,CAAC,SAAS;wBAC5B,uBAAuB,EAAE,IAAI;qBAC9B;oBACD,oBAAoB,EAAE,IAAI;iBAC3B,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBAC9B,MAAM,eAAe,CAAC,6BAA6B,CAAC;oBAClD,EAAE,EAAE,OAAO,CAAC,UAAU;oBACtB,IAAI,EAAE,EAAE,uBAAuB,EAAE,QAAQ,EAAE;oBAC3C,YAAY,EAAE;wBACZ,SAAS,EAAE,OAAO,CAAC,SAAS;wBAC5B,uBAAuB,EAAE,IAAI;qBAC9B;oBACD,oBAAoB,EAAE,IAAI;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,gDAAgD,KAAK,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,wEAAwE;IACjE,MAAM,CAAC,KAAK,CAAC,mBAAmB,CACrC,OAA6B;QAE7B,IAAI,CAAC;YACH,MAAM,GAAG,GAA4B,OAAO,CAAC,OAAO;gBAClD,CAAC,CAAC,MAAM,YAAY,CAAC,SAAS,CAAC;oBAC3B,KAAK,EAAE;wBACL,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE;wBAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;qBAC7B;oBACD,MAAM,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE;oBACzC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;iBACxB,CAAC;gBACJ,CAAC,CAAC,MAAM,eAAe,CAAC,SAAS,CAAC;oBAC9B,KAAK,EAAE;wBACL,GAAG,EAAE,OAAO,CAAC,UAAW,CAAC,QAAQ,EAAE;wBACnC,SAAS,EAAE,OAAO,CAAC,SAAS;qBAC7B;oBACD,MAAM,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE;oBACzC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;iBACxB,CAAC,CAAC;YACP,IAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,uBAAuB,EAAE,CAAC;gBACjC,OAAO,GAAG,CAAC,uBAAuB,CAAC;YACrC,CAAC;YAED,MAAM,QAAQ,GACZ,MAAM,qBAAqB,CAAC,iBAAiB,CAC3C,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CACvC,CAAC;YACJ,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/C,CAAC;YAED,MAAM,IAAI,GAIN,OAAO,CAAC,OAAO;gBACjB,CAAC,CAAC,MAAM,0BAA0B,CAAC,sBAAsB,CAAC;oBACtD,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC;gBACJ,CAAC,CAAC,MAAM,6BAA6B,CAAC,yBAAyB,CAAC;oBAC5D,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,UAAU,EAAE,OAAO,CAAC,UAAW;iBAChC,CAAC,CAAC;YACP,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC,aAAa,CACvB,IAAI,CAAC,cAAc,IAAI,0BAA0B,EACjD,OAAO,EACP,SAAS,EACT,IAAI,CAAC,iBAAiB,CACvB,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GACV,MAAM,SAAS,CAAC,8BAA8B,CAAC,OAAO,CAAC,SAAS,EAAE;gBAChE,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CAAC;YACL,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC,aAAa,CAAC,wBAAwB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACvE,CAAC;YACD,uCAAY,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,OAAO,CAAC,KAAE,MAAM,EAAE,SAAS,IAAG;QAC3E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,gDAAgD,KAAK,EAAE,CAAC,CAAC;YACtE,uCACK,IAAI,CAAC,MAAM,CAAC,0BAA0B,EAAE,OAAO,CAAC,KACnD,WAAW,EACT,sGAAsG,EACxG,MAAM,EAAE,SAAS,IACjB;QACJ,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,aAAa,CAC1B,IAAiC,EACjC,OAA6B,EAC7B,MAA+B,EAC/B,OAAkC;QAElC,OAAO,IAAI,CAAC,WAAW,CACrB,uBAAuB,EACvB,IAAI,EACJ,OAAO,EACP,MAAM,EACN,OAAO,CACR,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"InvestigationEligibility.js","sourceRoot":"","sources":["../../../../../../Server/Utils/AI/SRE/InvestigationEligibility.ts"],"names":[],"mappings":"AAOA,OAAO,SAAqC,MAAM,6BAA6B,CAAC;AAChF,OAAO,YAAY,MAAM,gCAAgC,CAAC;AAC1D,OAAO,eAAe,MAAM,mCAAmC,CAAC;AAChE,OAAO,MAAM,MAAM,cAAc,CAAC;AAClC,OAAO,qBAAqB,MAAM,yBAAyB,CAAC;AAC5D,OAAO,0BAA0B,MAAM,4BAA4B,CAAC;AACpE,OAAO,6BAA6B,MAAM,+BAA+B,CAAC;AAQ1E,MAAM,CAAC,OAAO,OAAO,wBAAwB;IACpC,MAAM,CAAC,MAAM,CAClB,IAAiC,EACjC,OAA6B,EAC7B,MAA+B,EAC/B,OAAkC;QAElC,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;IAEO,MAAM,CAAC,WAAW,CACxB,MAA4C,EAC5C,IAAiC,EACjC,OAA6B,EAC7B,MAA+B,EAC/B,OAAkC;;QAElC,MAAM,IAAI,GAAW,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QAC5D,MAAM,QAAQ,GAAY,MAAM,KAAK,UAAU,CAAC;QAChD,MAAM,cAAc,GAClB,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,qBAAqB,MAAK,SAAS;YAC1C,CAAC,CAAC,GAAG,OAAO,CAAC,qBAAqB,SAAS;YAC3C,CAAC,CAAC,YAAY,CAAC;QACnB,MAAM,OAAO,GAGT;YACF,WAAW,EAAE;gBACX,KAAK,EAAE,QAAQ;oBACb,CAAC,CAAC,uCAAuC;oBACzC,CAAC,CAAC,oCAAoC;gBACxC,WAAW,EAAE,QAAQ;oBACnB,CAAC,CAAC,8CAA8C,IAAI,6DAA6D;oBACjH,CAAC,CAAC,0FAA0F;gBAC9F,QAAQ,EAAE,QAAQ;oBAChB,CAAC,CAAC,iJAAiJ;oBACnJ,CAAC,CAAC,6JAA6J;aAClK;YACD,gCAAgC,EAAE;gBAChC,KAAK,EAAE,QAAQ;oBACb,CAAC,CAAC,aAAa,IAAI,oCAAoC;oBACvD,CAAC,CAAC,aAAa,IAAI,wCAAwC;gBAC7D,WAAW,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,+CAA+C,IAAI,eAAe,IAAI,eAAe,CAAC,CAAC,CAAC,wDAAwD,IAAI,IAAI,6DAA6D;gBAChP,QAAQ,EAAE,QAAQ;oBAChB,CAAC,CAAC,oBAAoB,IAAI,mCAAmC,IAAI,qEAAqE,IAAI,GAAG;oBAC7I,CAAC,CAAC,oBAAoB,IAAI,0BAA0B,IAAI,oDAAoD;aAC/G;YACD,gBAAgB,EAAE;gBAChB,KAAK,EAAE,QAAQ;oBACb,CAAC,CAAC,0CAA0C;oBAC5C,CAAC,CAAC,uCAAuC;gBAC3C,WAAW,EAAE,QAAQ;oBACnB,CAAC,CAAC,iDAAiD,IAAI,sEAAsE;oBAC7H,CAAC,CAAC,mIAAmI;gBACvI,QAAQ,EAAE,QAAQ;oBAChB,CAAC,CAAC,0IAA0I;oBAC5I,CAAC,CAAC,8IAA8I;aACnJ;YACD,uBAAuB,EAAE;gBACvB,KAAK,EAAE,QAAQ;oBACb,CAAC,CAAC,+CAA+C;oBACjD,CAAC,CAAC,4CAA4C;gBAChD,WAAW,EAAE,QAAQ;oBACnB,CAAC,CAAC,iDAAiD,IAAI,6DAA6D;oBACpH,CAAC,CAAC,4FAA4F;gBAChG,QAAQ,EAAE,QAAQ;oBAChB,CAAC,CAAC,mIAAmI;oBACrI,CAAC,CAAC,+HAA+H;aACpI;YACD,wBAAwB,EAAE;gBACxB,KAAK,EAAE,QAAQ;oBACb,CAAC,CAAC,4DAA4D;oBAC9D,CAAC,CAAC,uDAAuD;gBAC3D,WAAW,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,aAAa,IAAI,mBAAmB,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,GAAG,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,YAAY,EAAC,CAAC,CAAC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,eAAe,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,mBAAmB,EAAC,CAAC,CAAC,eAAe,OAAO,CAAC,mBAAmB,yBAAyB,CAAC,CAAC,CAAC,wCAAwC,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,0EAA0E,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC7b,QAAQ,EACN,sHAAsH;aACzH;YACD,gBAAgB,EAAE;gBAChB,KAAK,EAAE,QAAQ;oBACb,CAAC,CAAC,qCAAqC;oBACvC,CAAC,CAAC,0DAA0D;gBAC9D,WAAW,EAAE,QAAQ;oBACnB,CAAC,CAAC,WAAW,IAAI,mFAAmF,cAAc,+CAA+C,IAAI,uCAAuC;oBAC5M,CAAC,CAAC,qFAAqF,cAAc,sDAAsD,IAAI,2BAA2B;gBAC5L,QAAQ,EACN,+KAA+K;aAClL;YACD,sBAAsB,EAAE;gBACtB,KAAK,EACH,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,aAAa,MAAK,CAAC;oBACzB,CAAC,CAAC,QAAQ;wBACR,CAAC,CAAC,uDAAuD;wBACzD,CAAC,CAAC,gEAAgE;oBACpE,CAAC,CAAC,QAAQ;wBACR,CAAC,CAAC,wCAAwC;wBAC1C,CAAC,CAAC,8CAA8C;gBACtD,WAAW,EAAE,MAAM;oBACjB,CAAC,CAAC,eAAe,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC,eAAe,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,MAAA,MAAM,CAAC,aAAa,0CAAE,cAAc,CAAC,OAAO,CAAC,0BAA0B,QAAQ,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC,mEAAmE,EAAE;oBAC3U,CAAC,CAAC,4CAA4C,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,gFAAgF,CAAC,CAAC,CAAC,6DAA6D,EAAE;gBACtN,QAAQ,EACN,2IAA2I;aAC9I;YACD,mBAAmB,EAAE;gBACnB,KAAK,EAAE,QAAQ;oBACb,CAAC,CAAC,oCAAoC;oBACtC,CAAC,CAAC,yCAAyC;gBAC7C,WAAW,EAAE,QAAQ;oBACnB,CAAC,CAAC,0IAA0I;oBAC5I,CAAC,CAAC,mHAAmH;gBACvH,QAAQ,EACN,sHAAsH;aACzH;YACD,cAAc,EAAE;gBACd,KAAK,EAAE,QAAQ;oBACb,CAAC,CAAC,uCAAuC;oBACzC,CAAC,CAAC,wDAAwD;gBAC5D,WAAW,EAAE,QAAQ;oBACnB,CAAC,CAAC,uGAAuG;oBACzG,CAAC,CAAC,gGAAgG;gBACpG,QAAQ,EACN,sHAAsH;aACzH;YACD,wBAAwB,EAAE;gBACxB,KAAK,EAAE,QAAQ;oBACb,CAAC,CAAC,iDAAiD;oBACnD,CAAC,CAAC,sDAAsD;gBAC1D,WAAW,EAAE,QAAQ;oBACnB,CAAC,CAAC,wFAAwF;oBAC1F,CAAC,CAAC,yFAAyF;gBAC7F,QAAQ,EACN,uHAAuH;aAC1H;YACD,eAAe,EAAE;gBACf,KAAK,EAAE,+BAA+B;gBACtC,WAAW,EAAE,QAAQ,IAAI,6OAA6O;gBACtQ,QAAQ,EACN,iOAAiO;aACpO;SACF,CAAC;QACF,qCACE,IAAI,IACD,OAAO,CAAC,IAAI,CAAC,KAChB,WAAW,EAAE,QAAQ;gBACnB,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW;gBAC3B,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,4IAA4I,EAC5K,MAAM,EACN,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IACrC;IACJ,CAAC;IAED,8EAA8E;IACvE,MAAM,CAAC,KAAK,CAAC,aAAa,CAC/B,OAA6B,EAC7B,IAAiC,EACjC,MAA+B,EAC/B,OAAkC;QAElC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAkC,IAAI,CAAC,MAAM,CACzD,IAAI,EACJ,OAAO,EACP,MAAM,EACN,OAAO,CACR,CAAC;YACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,YAAY,CAAC,6BAA6B,CAAC;oBAC/C,EAAE,EAAE,OAAO,CAAC,OAAO;oBACnB,IAAI,EAAE,EAAE,uBAAuB,EAAE,QAAQ,EAAE;oBAC3C,YAAY,EAAE;wBACZ,SAAS,EAAE,OAAO,CAAC,SAAS;wBAC5B,uBAAuB,EAAE,IAAI;qBAC9B;oBACD,oBAAoB,EAAE,IAAI;iBAC3B,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBAC9B,MAAM,eAAe,CAAC,6BAA6B,CAAC;oBAClD,EAAE,EAAE,OAAO,CAAC,UAAU;oBACtB,IAAI,EAAE,EAAE,uBAAuB,EAAE,QAAQ,EAAE;oBAC3C,YAAY,EAAE;wBACZ,SAAS,EAAE,OAAO,CAAC,SAAS;wBAC5B,uBAAuB,EAAE,IAAI;qBAC9B;oBACD,oBAAoB,EAAE,IAAI;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,gDAAgD,KAAK,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,wEAAwE;IACjE,MAAM,CAAC,KAAK,CAAC,mBAAmB,CACrC,OAA6B;QAE7B,IAAI,CAAC;YACH,MAAM,GAAG,GAA4B,OAAO,CAAC,OAAO;gBAClD,CAAC,CAAC,MAAM,YAAY,CAAC,SAAS,CAAC;oBAC3B,KAAK,EAAE;wBACL,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE;wBAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;qBAC7B;oBACD,MAAM,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE;oBACzC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;iBACxB,CAAC;gBACJ,CAAC,CAAC,MAAM,eAAe,CAAC,SAAS,CAAC;oBAC9B,KAAK,EAAE;wBACL,GAAG,EAAE,OAAO,CAAC,UAAW,CAAC,QAAQ,EAAE;wBACnC,SAAS,EAAE,OAAO,CAAC,SAAS;qBAC7B;oBACD,MAAM,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE;oBACzC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;iBACxB,CAAC,CAAC;YACP,IAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,uBAAuB,EAAE,CAAC;gBACjC,OAAO,GAAG,CAAC,uBAAuB,CAAC;YACrC,CAAC;YAED,MAAM,QAAQ,GACZ,MAAM,qBAAqB,CAAC,iBAAiB,CAC3C,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CACvC,CAAC;YACJ,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/C,CAAC;YAED,MAAM,IAAI,GAIN,OAAO,CAAC,OAAO;gBACjB,CAAC,CAAC,MAAM,0BAA0B,CAAC,sBAAsB,CAAC;oBACtD,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC;gBACJ,CAAC,CAAC,MAAM,6BAA6B,CAAC,yBAAyB,CAAC;oBAC5D,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,UAAU,EAAE,OAAO,CAAC,UAAW;iBAChC,CAAC,CAAC;YACP,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC,aAAa,CACvB,IAAI,CAAC,cAAc,IAAI,0BAA0B,EACjD,OAAO,EACP,SAAS,EACT,IAAI,CAAC,iBAAiB,CACvB,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GACV,MAAM,SAAS,CAAC,8BAA8B,CAAC,OAAO,CAAC,SAAS,EAAE;gBAChE,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CAAC;YACL,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC,aAAa,CAAC,wBAAwB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACvE,CAAC;YACD,uCAAY,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,OAAO,CAAC,KAAE,MAAM,EAAE,SAAS,IAAG;QAC3E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,gDAAgD,KAAK,EAAE,CAAC,CAAC;YACtE,uCACK,IAAI,CAAC,MAAM,CAAC,0BAA0B,EAAE,OAAO,CAAC,KACnD,WAAW,EACT,sGAAsG,EACxG,MAAM,EAAE,SAAS,IACjB;QACJ,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,aAAa,CAC1B,IAAiC,EACjC,OAA6B,EAC7B,MAA+B,EAC/B,OAAkC;QAElC,OAAO,IAAI,CAAC,WAAW,CACrB,uBAAuB,EACvB,IAAI,EACJ,OAAO,EACP,MAAM,EACN,OAAO,CACR,CAAC;IACJ,CAAC;CACF"}

package/build/dist/Server/Utils/AI/SRE/InvestigationGrader.js

@@ -116,7 +116,7 @@ export default class InvestigationGrader {
              * executeWithLogging throw would file a permanent error for every
              * incident such a project ever resolves. It is a silent skip instead —
              * the same posture the sibling on-resolve job takes via
-             * AIInvestigationEngine.isEnabledForProject.
+             * AIIncidentPostmortemRunner.isEnabledForProject.
              */
             if (!(await AIService.isProjectAIEnabled(projectId))) {
                 logger.debug(`AI grading: AI is disabled for project ${projectId.toString()} — skipping.`);

package/build/dist/Server/Utils/AutoRemediation/CommandPlanExecutor.js

@@ -18,7 +18,7 @@ import { AiRemediationCommandExecutionStatus, AiRemediationCommandPlanUtil, AiRe
 import SortOrder from "../../../Types/BaseDatabase/SortOrder";
 import CommandPolicy from "../../../Utils/AiRemediation/CommandPolicy";
 import KubectlPolicy from "../../../Utils/AiRemediation/KubectlPolicy";
-import { KubectlCommandTier, KubernetesAiRemediationMode, } from "../../../Types/Kubernetes/KubernetesClusterAiAccess";
+import { KUBERNETES_AI_AGENT_DISPLAY_NAME, KubectlCommandTier, KubernetesAiRemediationMode, } from "../../../Types/Kubernetes/KubernetesClusterAiAccess";
 import RunbookStepType from "../../../Types/Runbook/RunbookStepType";
 import RunnerJobOrigin from "../../../Types/Runbook/RunnerJobOrigin";
 import { Green500, Red500 } from "../../../Types/BrandColors";
@@ -32,6 +32,11 @@ import Semaphore from "../../Infrastructure/Semaphore";
 import ToolResultSerializer from "../AI/Toolbox/Serializer";
 import KubectlJobRunner, { KubectlRunState, } from "../AI/ClusterAccess/KubectlJobRunner";
 import RemediationCommandToolkit from "../AI/Remediation/RemediationCommandTools";
+import ResourceCommandJobRunner, { ResourceCommandRunState, } from "../AI/ResourceAccess/ResourceCommandJobRunner";
+import { AI_RESOURCE_TYPE_INFO, isAiResourceType, } from "../../../Types/ResourceAiAgent/AiResourceType";
+import { ResourceAiRemediationMode, ResourceCommandTier, } from "../../../Types/ResourceAiAgent/ResourceAiAccess";
+import ResourceCommandPolicy from "../../../Utils/AiRemediation/Resource/ResourceCommandPolicy";
+import ResourceAiAccessService, { describeResourceNoun, } from "../../Services/ResourceAiAccessService";
 import logger from "../Logger";
 import CaptureSpan from "../Telemetry/CaptureSpan";
 /*
@@ -366,6 +371,20 @@ export default class CommandPlanExecutor {
                 leftForHuman.push(command);
                 anyFailed = true;
             }
+            /*
+             * The same for a resource command recorded as failed: its job is read
+             * the way every resource job is read
+             * (ResourceCommandJobRunner.getRunStateOfJobRow), and one that may
+             * have changed the resource is left for a human, never undone blind.
+             */
+            for (const command of await this.reconcileFailedResourceExecutions(suggestion, plan)) {
+                command.rollbackExecution = {
+                    status: AiRemediationCommandExecutionStatus.Skipped,
+                    errorMessage: `Rollback not run: the command reached the resource's AI agent but it did not report a finished result, so whether it changed the ${this.describeCommandResourceNoun(command)} is unknown. If it did, undo it manually: ${command.rollbackCommand}`,
+                };
+                leftForHuman.push(command);
+                anyFailed = true;
+            }
             if (plan.commands.some((command) => {
                 return (command.rollbackExecution !== undefined &&
                     !isSettledCommandExecutionStatus(command.rollbackExecution.status));
@@ -405,6 +424,7 @@ export default class CommandPlanExecutor {
                 const denyReason = this.getDenyReason({
                     stepType: command.stepType,
                     command: rollbackCommand,
+                    resourceType: command.resourceType,
                 });
                 if (denyReason) {
                     command.rollbackExecution = {
@@ -423,12 +443,24 @@ export default class CommandPlanExecutor {
                  * stopped bypassing them; a cluster whose remediation was turned
                  * off must not be changed at all. Left for a human, and said so.
                  */
-                const clusterRefusal = await this.getClusterExecutionRefusal({
+                /*
+                 * The same for a resource: its AI page as it is NOW, its agent, the
+                 * agent's write scope, and the resource's CURRENT mode and
+                 * allowlist (getResourceExecutionRefusal). Null for kubectl and
+                 * Bash/SSH, which the cluster re-check above covers.
+                 */
+                const clusterRefusal = (await this.getClusterExecutionRefusal({
                     suggestion,
                     command,
                     commandText: rollbackCommand,
                     purpose: "rollback",
-                });
+                })) ||
+                    (await this.getResourceExecutionRefusal({
+                        suggestion,
+                        command,
+                        commandText: rollbackCommand,
+                        purpose: "rollback",
+                    }));
                 if (clusterRefusal) {
                     command.rollbackExecution = {
                         status: AiRemediationCommandExecutionStatus.Skipped,
@@ -460,7 +492,7 @@ export default class CommandPlanExecutor {
                         claimTimeoutInMs: AI_COMMAND_CLAIM_TIMEOUT_MS,
                         executionTimeoutInMs: command.timeoutInMs,
                     });
-                    this.settleFromJob(command.rollbackExecution, terminalJob, "Rollback");
+                    this.settleFromJob(command.rollbackExecution, terminalJob, "Rollback", command);
                     if (command.rollbackExecution.status !==
                         AiRemediationCommandExecutionStatus.Succeeded) {
                         anyFailed = true;
@@ -487,7 +519,11 @@ export default class CommandPlanExecutor {
             await this.postFeedItem({
                 suggestion,
                 markdown: leftForHuman.length > 0
-                    ? `⚠️ **Auto-remediation rollback was not run for ${leftForHuman.length} command(s)** — the cluster no longer allows them unattended, or whether they ran could not be confirmed, so a human has to undo them. ${leftForHuman
+                    ? `⚠️ **Auto-remediation rollback was not run for ${leftForHuman.length} command(s)** — the ${leftForHuman.every((command) => {
+                        return command.stepType === RunbookStepType.ResourceCommand;
+                    })
+                        ? this.describeCommandResourceNoun(leftForHuman[0])
+                        : "cluster"} no longer allows them unattended, or whether they ran could not be confirmed, so a human has to undo them. ${leftForHuman
                         .map((command) => {
                         var _a;
                         return this.capForFeed(((_a = command.rollbackExecution) === null || _a === void 0 ? void 0 : _a.errorMessage) || "");
@@ -538,6 +574,7 @@ export default class CommandPlanExecutor {
         const denyReason = this.getDenyReason({
             stepType: command.stepType,
             command: command.command,
+            resourceType: command.resourceType,
         });
         if (denyReason) {
             return {
@@ -553,14 +590,22 @@ export default class CommandPlanExecutor {
          * Execution-time cluster re-check: the approve API re-checks the
          * project switches, this re-checks the cluster's own AI page. An
          * operator who turned remediation off, or bound a different Runner,
-         * after the plan was composed expects that to stop the plan too.
+         * after the plan was composed expects that to stop the plan too. A
+         * resource command gets the same re-check against its resource's AI
+         * page and agent (getResourceExecutionRefusal).
          */
-        const clusterRefusal = await this.getClusterExecutionRefusal({
+        const clusterRefusal = (await this.getClusterExecutionRefusal({
             suggestion,
             command,
             commandText: command.command,
             purpose: "command",
-        });
+        })) ||
+            (await this.getResourceExecutionRefusal({
+                suggestion,
+                command,
+                commandText: command.command,
+                purpose: "command",
+            }));
         if (clusterRefusal) {
             return {
                 state: {
@@ -627,7 +672,7 @@ export default class CommandPlanExecutor {
                 if (!isTerminalAgentJobStatus(terminalJob.status)) {
                     throw new Error("Command job did not reach a terminal state.");
                 }
-                this.settleFromJob(state, terminalJob, "Command");
+                this.settleFromJob(state, terminalJob, "Command", command);
                 facts = {
                     status: terminalJob.status,
                     exitCode: terminalJob.exitCode,
@@ -662,21 +707,75 @@ export default class CommandPlanExecutor {
                 errorMessage: state.errorMessage,
             });
         }
+        /*
+         * The same rule for a resource's "Last error": a success, or a failure
+         * about the resource's ACCESS as its program reports it
+         * (ResourceCommandJobRunner.isAccessFailure, with the program's own
+         * patterns).
+         */
+        if (started.recordsClusterOutcome &&
+            command.stepType === RunbookStepType.ResourceCommand &&
+            isAiResourceType(command.resourceType) &&
+            command.resourceId &&
+            ObjectID.isValidUUID(command.resourceId)) {
+            const resourceFacts = facts
+                ? Object.assign(Object.assign({}, facts), { program: this.getCommandProgram(command.command) }) : null;
+            const recordsResourceOutcome = succeeded ||
+                (resourceFacts !== null &&
+                    ResourceCommandJobRunner.isAccessFailure(resourceFacts));
+            if (recordsResourceOutcome) {
+                await ResourceAiAccessService.recordCommandOutcome({
+                    resourceType: command.resourceType,
+                    resourceId: new ObjectID(command.resourceId),
+                    succeeded,
+                    errorMessage: state.errorMessage,
+                });
+            }
+        }
         return state;
     }
+    // argv[0] of a resource command, for its program's rules.
+    static getCommandProgram(command) {
+        return (command || "").trim().split(/\s+/)[0] || "";
+    }
+    // "Docker host", "host" — the noun of a resource command's resource.
+    static describeCommandResourceNoun(command) {
+        return isAiResourceType(command.resourceType)
+            ? describeResourceNoun(command.resourceType)
+            : "resource";
+    }
     // Copy a terminal job's outcome onto an execution record.
-    static settleFromJob(state, job, label) {
+    static settleFromJob(state, job, label, 
+    // The command the job ran: a resource command's output gets its program's redaction.
+    command) {
         const succeeded = job.status === RunnerJobStatus.Succeeded;
         state.status = succeeded
             ? AiRemediationCommandExecutionStatus.Succeeded
             : AiRemediationCommandExecutionStatus.Failed;
         state.completedAt = OneUptimeDate.getCurrentDate().toISOString();
         state.exitCode = job.exitCode;
-        state.output = this.capOutput(job.output || "");
+        state.output = this.capCommandOutput(job.output || "", command);
         state.errorMessage = succeeded
             ? undefined
             : job.errorMessage || `${label} ended with status ${job.status}.`;
     }
+    /*
+     * The stored output of a command's job: a resource command's goes through
+     * the resource redaction (its program's rules, then the generic ones) at
+     * the stored cap; everything else through capOutput, as before.
+     */
+    static capCommandOutput(output, command) {
+        if ((command === null || command === void 0 ? void 0 : command.stepType) === RunbookStepType.ResourceCommand &&
+            isAiResourceType(command.resourceType)) {
+            return ResourceCommandJobRunner.redactAndCap({
+                output,
+                resourceType: command.resourceType,
+                program: this.getCommandProgram(command.command),
+                maxChars: MAX_STORED_OUTPUT_CHARS,
+            }).text;
+        }
+        return this.capOutput(output);
+    }
     /*
      * One enqueue for both lanes. Bash/SSH go through enqueueAiCommand
      * (script or SSH payload); Kubectl goes through enqueueAiKubectlCommand
@@ -684,6 +783,34 @@ export default class CommandPlanExecutor {
      */
     static async enqueue(data) {
         const { suggestion, command } = data;
+        /*
+         * A resource command goes through the resource chokepoint
+         * (enqueueAiResourceCommand), which re-runs the policy, the binding, the
+         * resource's fixes switch and the agent's write scope — and targets the
+         * agent the plan names, so a reset or replaced agent never receives a
+         * job composed for its predecessor.
+         */
+        if (command.stepType === RunbookStepType.ResourceCommand) {
+            if (!isAiResourceType(command.resourceType) ||
+                !command.resourceId ||
+                !ObjectID.isValidUUID(command.resourceId) ||
+                !ObjectID.isValidUUID(command.runnerId)) {
+                throw new Error("The resource command names no resource.");
+            }
+            return RunnerJobService.enqueueAiResourceCommand({
+                projectId: suggestion.projectId,
+                aiRunId: suggestion.aiRunId,
+                origin: RunnerJobOrigin.AiRemediation,
+                autoRemediationSuggestionId: suggestion.id,
+                resourceType: command.resourceType,
+                resourceId: new ObjectID(command.resourceId),
+                stepId: data.stepId,
+                targetResourceAiAgentId: new ObjectID(command.runnerId),
+                command: data.commandText,
+                timeoutInMs: command.timeoutInMs,
+                claimTimeoutInMs: AI_COMMAND_CLAIM_TIMEOUT_MS,
+            });
+        }
         if (command.stepType === RunbookStepType.Kubectl) {
             if (!command.kubernetesClusterId ||
                 !ObjectID.isValidUUID(command.kubernetesClusterId)) {
@@ -766,7 +893,9 @@ export default class CommandPlanExecutor {
             return `cluster "${status.clusterName}" no longer allows AI remediation${gap ? ` (${gap.title})` : ""}`;
         }
         if (!status.runner || status.runner.id !== command.runnerId) {
-            return `cluster "${status.clusterName}" is no longer reached through Runner "${command.runnerNameSnapshot}", which this plan was composed for`;
+            return `cluster "${status.clusterName}" is no longer reached through ${command.runnerNameSnapshot === KUBERNETES_AI_AGENT_DISPLAY_NAME
+                ? "the Kubernetes AI agent"
+                : `Runner "${command.runnerNameSnapshot}"`}, which this plan was composed for`;
         }
         if ((status.credentialId || undefined) !== (command.credentialId || undefined)) {
             return `cluster "${status.clusterName}" is no longer reached with the credential this plan was composed for`;
@@ -797,6 +926,82 @@ export default class CommandPlanExecutor {
         }
         return null;
     }
+    /*
+     * Why a resource command may NOT run on its resource right now, or null
+     * — getClusterExecutionRefusal for a resource. The plan froze the
+     * resource and the AI agent it was composed for; before anything is
+     * enqueued the resource's AI page is read again: fixes must still be on
+     * and ready, the agent must still be the one on the plan (a reset or
+     * replaced agent never receives a job meant for its predecessor), and
+     * the agent's reported write scope must let the command run. A rollback
+     * must ALSO be allowed unattended under the resource's CURRENT mode and
+     * allowlist: nothing shows a rollback to a human when it fires.
+     *
+     * Fails closed: a status that cannot be read is a refusal. Other step
+     * types pass through.
+     */
+    static async getResourceExecutionRefusal(data) {
+        const { suggestion, command } = data;
+        if (command.stepType !== RunbookStepType.ResourceCommand) {
+            return null;
+        }
+        if (!isAiResourceType(command.resourceType) ||
+            !command.resourceId ||
+            !ObjectID.isValidUUID(command.resourceId) ||
+            !suggestion.projectId) {
+            return "the resource command names no valid resource";
+        }
+        const resourceType = command.resourceType;
+        const noun = describeResourceNoun(resourceType);
+        const label = `${noun} "${command.resourceNameSnapshot || command.resourceId}"`;
+        let status;
+        try {
+            status = await ResourceAiAccessService.getStatusForResource({
+                projectId: suggestion.projectId,
+                resourceType,
+                resourceId: new ObjectID(command.resourceId),
+            });
+        }
+        catch (error) {
+            logger.error(`CommandPlanExecutor: could not read the AI access status of ${resourceType} ${command.resourceId} before a ${data.purpose}: ${error}`);
+            return `could not confirm that ${label} still allows AI remediation`;
+        }
+        if (!status) {
+            return `${label} no longer exists in this project`;
+        }
+        const liveLabel = `${noun} "${status.resourceName}"`;
+        if (!status.isRemediationReady) {
+            const gap = status.gaps.find((candidate) => {
+                return candidate.blocksRemediation;
+            });
+            return `${liveLabel} no longer allows AI remediation${gap ? ` (${gap.title})` : ""}`;
+        }
+        const agentName = AI_RESOURCE_TYPE_INFO[resourceType].agentDisplayName;
+        if (!status.agent || status.agent.agentId !== command.runnerId) {
+            return `${liveLabel} is no longer reached through the ${agentName} this plan was composed for (the agent was reset or replaced)`;
+        }
+        const scopeRefusal = RemediationCommandToolkit.getResourceWriteScopeRefusal({
+            resource: status,
+            command: data.commandText,
+        });
+        if (scopeRefusal) {
+            // The callers end the sentence themselves.
+            return `the ${agentName} would refuse it: ${scopeRefusal.endsWith(".") ? scopeRefusal.slice(0, -1) : scopeRefusal}`;
+        }
+        if (data.purpose === "rollback") {
+            const verdict = ResourceCommandPolicy.evaluateForAutoExecution({
+                resourceType,
+                command: data.commandText,
+                allowlistPatterns: status.aiCommandAllowlist,
+                bypassApproval: status.aiRemediationMode ===
+                    ResourceAiRemediationMode.BypassApproval,
+            });
+            if (verdict.verdict !== AiRemediationCommandPolicyVerdict.AutoApproved) {
+                return `${liveLabel} no longer allows this change unattended (its AI remediation mode is now ${status.aiRemediationMode}): ${verdict.reason}`;
+            }
+        }
+        return null;
+    }
     /*
      * The job a command's step ran under, when its record never got the job
      * id. The enqueue and the write that names the job are two steps; a pod
@@ -833,6 +1038,23 @@ export default class CommandPlanExecutor {
      * the Denied tier for Kubectl. Null when the command may run.
      */
     static getDenyReason(data) {
+        /*
+         * A resource command's floor is the Denied tier of its resource's
+         * command policy — never the bash denylist, and never a step whose
+         * resource type is unknown.
+         */
+        if (data.stepType === RunbookStepType.ResourceCommand) {
+            if (!isAiResourceType(data.resourceType)) {
+                return "the resource command names no valid resource type";
+            }
+            const resourcePolicy = ResourceCommandPolicy.evaluateCommand({
+                resourceType: data.resourceType,
+                command: data.command,
+            });
+            return resourcePolicy.tier === ResourceCommandTier.Denied
+                ? resourcePolicy.reason
+                : null;
+        }
         if (data.stepType === RunbookStepType.Kubectl) {
             const policy = KubectlPolicy.evaluateCommand(data.command);
             return policy.tier === KubectlCommandTier.Denied ? policy.reason : null;
@@ -911,7 +1133,7 @@ export default class CommandPlanExecutor {
                     ? AiRemediationCommandExecutionStatus.Succeeded
                     : AiRemediationCommandExecutionStatus.Failed;
                 execution.exitCode = job.exitCode;
-                execution.output = this.capOutput(job.output || "");
+                execution.output = this.capCommandOutput(job.output || "", command);
                 execution.errorMessage = succeeded
                     ? undefined
                     : job.errorMessage ||
@@ -976,7 +1198,7 @@ export default class CommandPlanExecutor {
                     });
                 }
                 if (isTerminalAgentJobStatus(job.status)) {
-                    this.settleFromJob(rollback, job, "Rollback");
+                    this.settleFromJob(rollback, job, "Rollback", command);
                     changed = true;
                 }
             }
@@ -1039,7 +1261,7 @@ export default class CommandPlanExecutor {
                 logger.error(`CommandPlanExecutor: could not read whether command ${command.sequence} of suggestion ${(_a = suggestion.id) === null || _a === void 0 ? void 0 : _a.toString()} ran: ${error}`);
             }
             if (job && job.status === RunnerJobStatus.Succeeded) {
-                this.settleFromJob(execution, job, "Command");
+                this.settleFromJob(execution, job, "Command", command);
                 changed = true;
                 continue;
             }
@@ -1053,6 +1275,63 @@ export default class CommandPlanExecutor {
         }
         return mayHaveRun;
     }
+    /*
+     * reconcileFailedKubectlExecutions for resource commands: the ones
+     * recorded as Failed that may nonetheless have changed the resource,
+     * read from their jobs the way ResourceCommandJobRunner reads every
+     * resource job. A job that Succeeded after all is settled from the job
+     * (and so rolled back like any other); one whose run is Unknown, or whose
+     * program ran without finishing (the agent killed it at its timeout), is
+     * returned — its undo is not run blind; one that certainly never ran, or
+     * whose program finished and reported a failure, owes no undo.
+     */
+    static async reconcileFailedResourceExecutions(suggestion, plan) {
+        var _a;
+        const mayHaveRun = [];
+        let changed = false;
+        for (const command of plan.commands) {
+            const execution = command.execution;
+            if (command.stepType !== RunbookStepType.ResourceCommand ||
+                !execution ||
+                execution.status !== AiRemediationCommandExecutionStatus.Failed ||
+                !execution.runnerJobId ||
+                !command.rollbackCommand ||
+                command.rollbackExecution) {
+                continue;
+            }
+            let runState = ResourceCommandRunState.Unknown;
+            let job = null;
+            try {
+                job = ObjectID.isValidUUID(execution.runnerJobId)
+                    ? await RunnerJobService.findOneById({
+                        id: new ObjectID(execution.runnerJobId),
+                        select: RUN_STATE_JOB_SELECT,
+                        props: { isRoot: true },
+                    })
+                    : null;
+                if (job) {
+                    runState = ResourceCommandJobRunner.getRunStateOfJobRow(job);
+                }
+            }
+            catch (error) {
+                logger.error(`CommandPlanExecutor: could not read whether resource command ${command.sequence} of suggestion ${(_a = suggestion.id) === null || _a === void 0 ? void 0 : _a.toString()} ran: ${error}`);
+            }
+            if (job && job.status === RunnerJobStatus.Succeeded) {
+                this.settleFromJob(execution, job, "Command", command);
+                changed = true;
+                continue;
+            }
+            const programFinished = runState === ResourceCommandRunState.Ran &&
+                typeof (job === null || job === void 0 ? void 0 : job.exitCode) === "number";
+            if (runState !== ResourceCommandRunState.NotRun && !programFinished) {
+                mayHaveRun.push(command);
+            }
+        }
+        if (changed) {
+            await this.persistPlan(suggestion, plan, "rollback");
+        }
+        return mayHaveRun;
+    }
     static describeRollbackOutcome(plan) {
         var _a;
         let rolledBack = 0;