@oneuptime/common 14.0.8 → 14.0.9

package/Tests/Utils/AiRemediation/KubernetesAiAgentPolicyCopyParity.test.ts

@@ -0,0 +1,396 @@
+import fs from "fs";
+import os from "os";
+import path from "path";
+import ts from "typescript";
+
+/*
+ * The Kubernetes AI agent (agents/KubernetesAIAgent) enforces the same
+ * kubectl rules as the server before it spawns anything: KubectlPolicy tiers
+ * the argv, KubectlWriteScope bounds where a write may land. It is a
+ * standalone package with no Common dependency, so it carries BYTE-IDENTICAL
+ * copies of those files (and everything they import) under
+ * agents/KubernetesAIAgent/Common/, in the same relative layout — plus the
+ * Runner's KubectlArgvGuard. If a copy drifts, the two sides of the trust
+ * boundary disagree about a command: the server approves what the agent
+ * refuses (every fix fails in the cluster), or the agent runs what the
+ * server would now refuse.
+ *
+ * So this fails when:
+ *   - a copy differs from its source (run `npm run sync-common` in
+ *     agents/KubernetesAIAgent);
+ *   - the policy closure starts importing a file that is not copied (add it
+ *     to agents/KubernetesAIAgent/Scripts/CommonCopies.json and sync), or
+ *     anything that is not a relative import — a package, or the
+ *     "Common/..." alias, which the agent cannot resolve;
+ *   - the agent imports a Common file that is not in the copied set, or the
+ *     set carries a copy nothing uses.
+ *
+ * Files (and the copy list) are read with fs, never required: Common's jest
+ * config maps any specifier containing "Common/" to this package, which
+ * would silently compare a file with itself.
+ */
+
+const REPO_ROOT: string = path.resolve(__dirname, "..", "..", "..", "..", "..");
+const COMMON_ROOT: string = path.join(REPO_ROOT, "packages", "Common");
+const AGENT_ROOT: string = path.join(REPO_ROOT, "agents", "KubernetesAIAgent");
+const AGENT_COMMON_ROOT: string = path.join(AGENT_ROOT, "Common");
+// The list Scripts/SyncCommon.js (npm run sync-common) copies from.
+const COPY_LIST: string = path.join(AGENT_ROOT, "Scripts", "CommonCopies.json");
+
+interface CopyList {
+  commonPolicyFiles: Array<string>;
+  otherCopies: Array<{ source: string; target: string }>;
+}
+
+const copyList: CopyList = JSON.parse(
+  fs.readFileSync(COPY_LIST, "utf8"),
+) as CopyList;
+
+const COPIED: Array<string> = [...copyList.commonPolicyFiles].sort();
+
+// Every module specifier a TypeScript file imports or re-exports.
+function getImportSpecifiers(file: string): Array<string> {
+  const source: ts.SourceFile = ts.createSourceFile(
+    file,
+    fs.readFileSync(file, "utf8"),
+    ts.ScriptTarget.Latest,
+    true,
+  );
+  const specifiers: Array<string> = [];
+
+  const visit: (node: ts.Node) => void = (node: ts.Node): void => {
+    if (
+      (ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) &&
+      node.moduleSpecifier &&
+      ts.isStringLiteral(node.moduleSpecifier)
+    ) {
+      specifiers.push(node.moduleSpecifier.text);
+    }
+
+    if (
+      ts.isImportEqualsDeclaration(node) &&
+      ts.isExternalModuleReference(node.moduleReference) &&
+      ts.isStringLiteral(node.moduleReference.expression)
+    ) {
+      specifiers.push(node.moduleReference.expression.text);
+    }
+
+    if (
+      ts.isCallExpression(node) &&
+      (node.expression.kind === ts.SyntaxKind.ImportKeyword ||
+        (ts.isIdentifier(node.expression) &&
+          node.expression.text === "require")) &&
+      node.arguments[0] &&
+      ts.isStringLiteral(node.arguments[0])
+    ) {
+      specifiers.push(node.arguments[0].text);
+    }
+
+    ts.forEachChild(node, visit);
+  };
+
+  visit(source);
+  return specifiers;
+}
+
+// A relative specifier resolved to a .ts file, or null when none exists.
+function resolveRelative(fromFile: string, specifier: string): string | null {
+  const base: string = path.resolve(path.dirname(fromFile), specifier);
+
+  for (const candidate of [
+    `${base}.ts`,
+    `${base}.tsx`,
+    path.join(base, "index.ts"),
+    path.join(base, "Index.ts"),
+  ]) {
+    if (fs.existsSync(candidate)) {
+      return candidate;
+    }
+  }
+
+  return null;
+}
+
+/*
+ * Walk the import graph from these Common files; returns every file reached
+ * (Common-relative) and every import that leaves the closure.
+ */
+function walkClosure(
+  entries: Array<string>,
+  root: string = COMMON_ROOT,
+): {
+  files: Array<string>;
+  problems: Array<string>;
+} {
+  const seen: Set<string> = new Set<string>();
+  const problems: Array<string> = [];
+  const stack: Array<string> = entries.map((relative: string): string => {
+    return path.join(root, relative);
+  });
+
+  while (stack.length > 0) {
+    const file: string = stack.pop()!;
+
+    if (seen.has(file)) {
+      continue;
+    }
+    seen.add(file);
+
+    for (const specifier of getImportSpecifiers(file)) {
+      const from: string = path.relative(root, file);
+
+      if (!specifier.startsWith(".")) {
+        problems.push(
+          `${from} imports "${specifier}", which is not a relative import the agent can carry`,
+        );
+        continue;
+      }
+
+      const resolved: string | null = resolveRelative(file, specifier);
+
+      if (!resolved) {
+        problems.push(`${from} imports "${specifier}", which does not resolve`);
+        continue;
+      }
+
+      if (!resolved.startsWith(`${root}${path.sep}`)) {
+        problems.push(
+          `${from} imports "${specifier}", outside packages/Common`,
+        );
+        continue;
+      }
+
+      stack.push(resolved);
+    }
+  }
+
+  return {
+    files: Array.from(seen)
+      .map((file: string): string => {
+        return path.relative(root, file).split(path.sep).join("/");
+      })
+      .sort(),
+    problems,
+  };
+}
+
+// The agent's own sources (everything but the copies, builds and deps).
+function listAgentSources(dir: string = AGENT_ROOT): Array<string> {
+  const files: Array<string> = [];
+
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full: string = path.join(dir, entry.name);
+
+    if (entry.isDirectory()) {
+      if (
+        ["node_modules", "build", "Common"].includes(entry.name) &&
+        dir === AGENT_ROOT
+      ) {
+        continue;
+      }
+      files.push(...listAgentSources(full));
+    } else if (entry.name.endsWith(".ts")) {
+      files.push(full);
+    }
+  }
+
+  return files;
+}
+
+// The copied Common files the agent's own sources import directly.
+function getAgentEntryPoints(): Array<string> {
+  const entries: Set<string> = new Set<string>();
+
+  for (const file of listAgentSources()) {
+    for (const specifier of getImportSpecifiers(file)) {
+      if (!specifier.startsWith(".")) {
+        continue;
+      }
+
+      const target: string = path.resolve(path.dirname(file), specifier);
+
+      if (target.startsWith(`${AGENT_COMMON_ROOT}${path.sep}`)) {
+        entries.add(
+          path
+            .relative(AGENT_COMMON_ROOT, `${target}.ts`)
+            .split(path.sep)
+            .join("/"),
+        );
+      }
+    }
+  }
+
+  return Array.from(entries).sort();
+}
+
+describe("Kubernetes AI agent: copies of the kubectl policy closure", () => {
+  test("the copied set is the policy and everything it imports", () => {
+    expect(COPIED).toEqual(
+      expect.arrayContaining([
+        "Utils/AiRemediation/KubectlPolicy.ts",
+        "Utils/AiRemediation/KubectlWriteScope.ts",
+        "Utils/AiRemediation/CommandPolicy.ts",
+        "Types/Kubernetes/KubernetesClusterAiAccess.ts",
+        "Types/AutoRemediation/AiRemediationCommandPolicyVerdict.ts",
+      ]),
+    );
+  });
+
+  test.each(COPIED)(
+    "Common/%s is byte-identical to its source",
+    (relative: string) => {
+      const source: Buffer = fs.readFileSync(path.join(COMMON_ROOT, relative));
+      const copyPath: string = path.join(AGENT_COMMON_ROOT, relative);
+
+      expect({ relative, copied: fs.existsSync(copyPath) }).toEqual({
+        relative,
+        copied: true,
+      });
+      expect({
+        relative,
+        identical: source.equals(fs.readFileSync(copyPath)),
+      }).toEqual({
+        relative,
+        identical: true,
+      });
+    },
+  );
+
+  test.each(
+    copyList.otherCopies.map((copy: { source: string; target: string }) => {
+      return [copy.target, copy.source];
+    }),
+  )("%s is byte-identical to %s", (target: string, source: string) => {
+    expect(
+      fs
+        .readFileSync(path.join(REPO_ROOT, source))
+        .equals(fs.readFileSync(path.join(AGENT_ROOT, target))),
+    ).toBe(true);
+  });
+
+  test("the argv guard is among the verbatim copies", () => {
+    expect(copyList.otherCopies).toContainEqual({
+      source: "packages/Runner/Utils/KubectlArgvGuard.ts",
+      target: "KubectlArgvGuard.ts",
+    });
+  });
+
+  test("the closure imports nothing outside the copied set", () => {
+    const closure: { files: Array<string>; problems: Array<string> } =
+      walkClosure(COPIED);
+
+    expect(closure.problems).toEqual([]);
+    expect(closure.files).toEqual(COPIED);
+  });
+
+  test("the agent imports only copied files, and every copy is used", () => {
+    const entries: Array<string> = getAgentEntryPoints();
+
+    // Imported directly by the agent...
+    for (const entry of entries) {
+      expect({ entry, copied: COPIED.includes(entry) }).toEqual({
+        entry,
+        copied: true,
+      });
+    }
+
+    // ...and nothing copied that neither the agent nor the closure needs.
+    expect(walkClosure(entries).files).toEqual(COPIED);
+  });
+
+  test("the agent directory holds no stray copies", () => {
+    const present: Array<string> = [];
+    const walk: (dir: string) => void = (dir: string): void => {
+      for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        const full: string = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+          walk(full);
+        } else {
+          present.push(
+            path.relative(AGENT_COMMON_ROOT, full).split(path.sep).join("/"),
+          );
+        }
+      }
+    };
+    walk(AGENT_COMMON_ROOT);
+
+    expect(present.sort()).toEqual(COPIED);
+  });
+
+  describe("the checks themselves", () => {
+    test("imports that leave the closure are reported", () => {
+      const scratch: string = fs.mkdtempSync(path.join(os.tmpdir(), "parity-"));
+      const root: string = path.join(scratch, "Common");
+
+      try {
+        fs.mkdirSync(root);
+        fs.writeFileSync(
+          path.join(scratch, "Outside.ts"),
+          "export default 1;\n",
+        );
+        fs.writeFileSync(path.join(root, "Inside.ts"), "export default 2;\n");
+        fs.writeFileSync(
+          path.join(root, "Leaf.ts"),
+          [
+            'import x from "lodash";',
+            'import y from "./Missing";',
+            'import z from "Common/Types/JSON";',
+            'import o from "../Outside";',
+            'import i from "./Inside";',
+            "export default [x, y, z, o, i];",
+            "",
+          ].join("\n"),
+        );
+
+        const closure: { files: Array<string>; problems: Array<string> } =
+          walkClosure(["Leaf.ts"], root);
+
+        expect(closure.files).toEqual(["Inside.ts", "Leaf.ts"]);
+        expect(closure.problems).toHaveLength(4);
+        expect(closure.problems[0]).toMatch(
+          /imports "lodash", which is not a relative import/,
+        );
+        expect(closure.problems[1]).toMatch(
+          /"\.\/Missing", which does not resolve/,
+        );
+        expect(closure.problems[2]).toMatch(/imports "Common\/Types\/JSON"/);
+        expect(closure.problems[3]).toMatch(
+          /"\.\.\/Outside", outside packages\/Common/,
+        );
+      } finally {
+        fs.rmSync(scratch, { recursive: true, force: true });
+      }
+    });
+
+    test("import specifiers are found in every form", () => {
+      const scratch: string = fs.mkdtempSync(path.join(os.tmpdir(), "parity-"));
+
+      try {
+        const file: string = path.join(scratch, "Forms.ts");
+        fs.writeFileSync(
+          file,
+          [
+            'import a from "./a";',
+            'import type { B } from "./b";',
+            'export { c } from "./c";',
+            'export * from "./d";',
+            'const e = require("./e");',
+            'const f = import("./f");',
+            "",
+          ].join("\n"),
+        );
+
+        expect(getImportSpecifiers(file)).toEqual([
+          "./a",
+          "./b",
+          "./c",
+          "./d",
+          "./e",
+          "./f",
+        ]);
+      } finally {
+        fs.rmSync(scratch, { recursive: true, force: true });
+      }
+    });
+  });
+});

package/Tests/Utils/Dashboard/DashboardTimeRangeZoom.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, test } from "@jest/globals";
+import { afterEach, describe, expect, jest, test } from "@jest/globals";
 import DashboardTimeRangeZoomUtil, {
   DashboardTimeRangeZoomState,
 } from "../../../Utils/Dashboard/DashboardTimeRangeZoom";
@@ -165,6 +165,109 @@ describe("DashboardTimeRangeZoomUtil", () => {
     });
   });
 
+  /*
+   * Issue #4105: a panel's selection runs to the END of its last bucket, and
+   * the newest bucket of a rolling range is still filling up. Taken whole, a
+   * drag onto it would zoom the whole board to a window that ends in the
+   * future. The board's zoom now follows the same rule as the page-wide
+   * zoom and the log and trace histograms: never past the end of the window
+   * the board is on.
+   */
+  describe("zoomToWindow never runs past the board's window", () => {
+    afterEach(() => {
+      jest.useRealTimers();
+    });
+
+    test("a drag onto the newest bucket of a rolling range stops at now", () => {
+      jest.useFakeTimers();
+      jest.setSystemTime(new Date("2026-09-28T12:00:00.000Z"));
+      const state: DashboardTimeRangeZoomState =
+        DashboardTimeRangeZoomUtil.getInitialState(ROLLING_HOUR);
+
+      const zoomed: DashboardTimeRangeZoomState =
+        DashboardTimeRangeZoomUtil.zoomToWindow(
+          state,
+          new Date("2026-09-28T11:50:00.000Z"),
+          new Date("2026-09-28T12:01:00.000Z"),
+        );
+
+      expect(zoomed.current.startAndEndDate?.startValue.toISOString()).toBe(
+        "2026-09-28T11:50:00.000Z",
+      );
+      expect(zoomed.current.startAndEndDate?.endValue.toISOString()).toBe(
+        "2026-09-28T12:00:00.000Z",
+      );
+      // The way back is untouched: the rolling hour itself.
+      expect(zoomed.baseline).toBe(ROLLING_HOUR);
+    });
+
+    test("a drag past the end of a pinned range stops at that end", () => {
+      const state: DashboardTimeRangeZoomState =
+        DashboardTimeRangeZoomUtil.getInitialState(PINNED_DAY);
+
+      const zoomed: DashboardTimeRangeZoomState =
+        DashboardTimeRangeZoomUtil.zoomToWindow(
+          state,
+          new Date("2026-08-20T23:30:00.000Z"),
+          new Date("2026-08-21T00:10:00.000Z"),
+        );
+
+      expect(zoomed.current.startAndEndDate?.endValue.toISOString()).toBe(
+        "2026-08-21T00:00:00.000Z",
+      );
+    });
+
+    test("a drag wholly inside the window is kept as it is", () => {
+      const state: DashboardTimeRangeZoomState =
+        DashboardTimeRangeZoomUtil.getInitialState(PINNED_DAY);
+
+      const zoomed: DashboardTimeRangeZoomState =
+        DashboardTimeRangeZoomUtil.zoomToWindow(state, DRAG_START, DRAG_END);
+
+      expect(zoomed.current.startAndEndDate?.endValue).toEqual(DRAG_END);
+    });
+
+    test("a selection that starts after the window ends is not clamped away", () => {
+      // The chart can still be drawing a window the board has since left.
+      const state: DashboardTimeRangeZoomState =
+        DashboardTimeRangeZoomUtil.getInitialState(PINNED_DAY);
+
+      const zoomed: DashboardTimeRangeZoomState =
+        DashboardTimeRangeZoomUtil.zoomToWindow(
+          state,
+          new Date("2026-08-22T01:00:00.000Z"),
+          new Date("2026-08-22T02:00:00.000Z"),
+        );
+
+      expect(zoomed.current.startAndEndDate?.startValue.toISOString()).toBe(
+        "2026-08-22T01:00:00.000Z",
+      );
+      expect(zoomed.current.startAndEndDate?.endValue.toISOString()).toBe(
+        "2026-08-22T02:00:00.000Z",
+      );
+    });
+
+    test("the zoomed window's end is clamped against the CURRENT window, even when already zoomed", () => {
+      const first: DashboardTimeRangeZoomState =
+        DashboardTimeRangeZoomUtil.zoomToWindow(
+          DashboardTimeRangeZoomUtil.getInitialState(PINNED_DAY),
+          DRAG_START,
+          DRAG_END,
+        );
+
+      const second: DashboardTimeRangeZoomState =
+        DashboardTimeRangeZoomUtil.zoomToWindow(
+          first,
+          NARROWER_START,
+          new Date("2026-08-20T09:40:00.000Z"),
+        );
+
+      expect(second.current.startAndEndDate?.endValue).toEqual(DRAG_END);
+      // And the original range is still the way back.
+      expect(second.baseline).toBe(PINNED_DAY);
+    });
+  });
+
   describe("resetZoom", () => {
     test("restores the range the board had before the first drag", () => {
       const zoomed: DashboardTimeRangeZoomState =

package/Types/AI/AIRunType.ts

@@ -17,12 +17,17 @@ enum AIRunType {
   RemediationPlan = "RemediationPlan",
   /*
    * An auto-remediation run that COMPOSES commands instead of picking a
-   * runbook (rules with aiComposesCommands). In Suggest mode it
+   * runbook: rules with aiComposesCommands, and cluster rounds a
+   * Kubernetes cluster's AI agent page asks for. In Suggest mode it
    * investigates read-only and proposes a command plan for one-click
    * approval; in FullAuto mode it may also execute commands inline, but
-   * only ones that match the rule's operator-authored allowlist and pass
-   * the structural policy guard. Requires Project.enableAiCommandExecution
-   * and a target Runner with canRunAiCommands.
+   * only ones that pass the structural policy guard and match the rule's
+   * operator-authored allowlist (or the cluster's Fixes mode). Rule runs
+   * require Project.enableAiCommandExecution (Bash/SSH on Runners, and any
+   * kubectl a rule composes) and a target Runner with canRunAiCommands. A
+   * cluster round's consent is the cluster's Fixes mode plus the Kubernetes
+   * agent chart's write access; it needs the project opt-in only when the
+   * cluster is reached through a Runner with a Kubernetes credential.
    */
   RemediationExecution = "RemediationExecution",
 }

package/Types/AI/InvestigationNotStartedReason.ts

@@ -2,6 +2,12 @@ export type InvestigationNotStartedCode =
   | "ai_disabled"
   | "automatic_investigation_disabled"
   | "provider_missing"
+  /*
+   * The project runs on OneUptime's own (billed) LLM provider and has no AI
+   * credits left, with auto-recharge off — every model call would be
+   * refused with "Insufficient AI balance", so no run is started.
+   */
+  | "insufficient_ai_balance"
   | "severity_below_threshold"
   | "monitor_cooldown"
   | "daily_budget_exhausted"

package/Types/AutoRemediation/AiRemediationCommandPlan.ts

@@ -4,6 +4,20 @@ import {
   KubectlCommandTier,
   PROTECTED_KUBERNETES_NAMESPACES,
 } from "../Kubernetes/KubernetesClusterAiAccess";
+import {
+  AiRemediationCommandPolicyVerdict,
+  MAX_COMMAND_LENGTH_CHARS,
+} from "./AiRemediationCommandPolicyVerdict";
+
+/*
+ * Defined in a leaf module of their own (no imports) so the pure kubectl
+ * policy closure — KubectlPolicy, KubectlWriteScope, CommandPolicy and the
+ * types they read — can be copied verbatim into the standalone Kubernetes AI
+ * agent (agents/KubernetesAIAgent) without dragging this file, and through
+ * its JSON import most of Common, along. Re-exported here so every existing
+ * importer keeps working.
+ */
+export { AiRemediationCommandPolicyVerdict, MAX_COMMAND_LENGTH_CHARS };
 
 /*
  * The AI-composed command plan stored on
@@ -26,21 +40,6 @@ export const AI_COMMAND_STEP_TYPES: Array<RunbookStepType> = [
   RunbookStepType.Kubectl,
 ];
 
-export enum AiRemediationCommandPolicyVerdict {
-  /*
-   * Matched the rule's operator-authored allowlist and passed the
-   * structural chain guard — eligible for FullAuto inline execution.
-   */
-  AutoApproved = "AutoApproved",
-  // Not denylisted, but a human must approve before it runs.
-  RequiresApproval = "RequiresApproval",
-  /*
-   * Matched the hard denylist. Denied commands are never stored in a plan —
-   * the verdict exists so policy evaluation has a complete result type.
-   */
-  Denied = "Denied",
-}
-
 export enum AiRemediationCommandExecutionStatus {
   Pending = "Pending",
   Running = "Running",
@@ -186,7 +185,6 @@ export function getRollbackCommandStepId(
 
 // Hard caps — enforced at plan acceptance, not just in the prompt.
 export const MAX_PLAN_COMMANDS: number = 5;
-export const MAX_COMMAND_LENGTH_CHARS: number = 2000;
 export const MIN_COMMAND_TIMEOUT_MS: number = 1000;
 export const MAX_COMMAND_TIMEOUT_MS: number = 5 * 60 * 1000;
 export const DEFAULT_COMMAND_TIMEOUT_MS: number = 60 * 1000;

package/Types/AutoRemediation/AiRemediationCommandPolicyVerdict.ts

@@ -0,0 +1,28 @@
+/*
+ * The verdict the command policies (CommandPolicy, KubectlPolicy) give one
+ * AI-composed command, and the longest command either accepts.
+ *
+ * A leaf module with no imports on purpose: it is part of the pure policy
+ * closure that agents/KubernetesAIAgent carries a byte-identical copy of
+ * (see Tests/Utils/AiRemediation/KubernetesAiAgentPolicyCopyParity.test.ts),
+ * so it must never import anything outside that closure.
+ * AiRemediationCommandPlan re-exports both names.
+ */
+
+export enum AiRemediationCommandPolicyVerdict {
+  /*
+   * Matched the rule's operator-authored allowlist and passed the
+   * structural chain guard — eligible for FullAuto inline execution.
+   */
+  AutoApproved = "AutoApproved",
+  // Not denylisted, but a human must approve before it runs.
+  RequiresApproval = "RequiresApproval",
+  /*
+   * Matched the hard denylist. Denied commands are never stored in a plan —
+   * the verdict exists so policy evaluation has a complete result type.
+   */
+  Denied = "Denied",
+}
+
+// Hard cap — enforced at plan acceptance, not just in the prompt.
+export const MAX_COMMAND_LENGTH_CHARS: number = 2000;

package/Types/Dashboard/DashboardComponents/DashboardTraceChartComponent.ts

@@ -38,7 +38,8 @@ export default interface DashboardTraceChartComponent extends BaseComponent {
      * (e.g. "#6366f1"). Single-series → the series color; split charts → the
      * first unpinned series, with the rest following the default palette.
      * Same semantics as MetricQueryConfigData.color on the metric Chart
-     * widget. Unset = Auto (default palette).
+     * widget. Unset = Auto (default palette). A split by statusCode ignores
+     * it: each status keeps its own color unless pinned.
      */
     color?: string | undefined;
     /*
@@ -46,7 +47,8 @@ export default interface DashboardTraceChartComponent extends BaseComponent {
      * (e.g. { "url.host=api.example.com": "#10b981" }) — the same storage
      * shape as MetricQueryConfigData.colorsByGroup, so the shared
      * SeriesGroupColorSelector editor works unchanged. Unpinned series fall
-     * back to `color` (lead) then the default palette.
+     * back to `color` (lead) then the default palette — or, in a statusCode
+     * split, to each status's own color.
      */
     colorsByGroup?: Record<string, string> | undefined;
     /*