@oneuptime/common 14.0.9 → 14.0.10

package/Server/Infrastructure/Postgres/SchemaMigrations/1796300000000-AddResourceAiAgents.ts

@@ -0,0 +1,423 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Resource AI agents: OneUptime AI access to Docker and Podman hosts, Docker
+ * Swarm, Proxmox and Ceph clusters, VMware vCenters, database servers and
+ * hosts, through the AI agent installed next to each one — the same
+ * strategy as the Kubernetes AI agent, whose tables this does not touch.
+ *
+ * Schema only (generated):
+ *   - ResourceAiAgent: one row per resource for its AI agent (its own
+ *     identity, never a Runner). Polymorphic: keyed by (resourceType,
+ *     resourceId) with NO foreign key on resourceId, which points into a
+ *     different table for every resource type; unique per live resource;
+ *     cascades with its project.
+ *   - RunnerJob.targetResourceAiAgentId: the agent an AI resource command
+ *     (step type ResourceCommand) is targeted at (SET NULL when the agent
+ *     row goes), and RunnerJob.resourceType / resourceId: the resource it
+ *     ran against, for the resource's AI page.
+ *   - AutoRemediationSuggestion.resourceType / resourceId: the resource
+ *     whose AI remediation mode produced a suggestion (no rule).
+ *   - The AI access columns of DockerHost, PodmanHost, CephCluster,
+ *     ProxmoxCluster, DockerSwarmCluster, VMwareVCenter, Host and
+ *     DatabaseServer: isAiInvestigationEnabled (default false),
+ *     aiRemediationMode (default Disabled), aiCommandAllowlist and the
+ *     server-written aiAccessLastVerifiedAt, aiAccessLastError and
+ *     aiAccessConfiguredAt.
+ *
+ * No data is rewritten: every existing resource starts with AI switched
+ * off, exactly like a new one. down() reverses the schema.
+ */
+export class AddResourceAiAgents1796300000000 implements MigrationInterface {
+  public name: string = "AddResourceAiAgents1796300000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "ResourceAiAgent" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "resourceType" character varying(100) NOT NULL, "resourceId" uuid NOT NULL, "resourceIdentifier" character varying(500), "keyHash" character varying(100), "agentVersion" character varying(100), "posture" jsonb, "lastAliveAt" TIMESTAMP WITH TIME ZONE, "connectionStatus" character varying(100) NOT NULL DEFAULT 'disconnected', "lastRegisteredAt" TIMESTAMP WITH TIME ZONE, "registeredWithIngestionKeyId" uuid, "lastRefusedRegistrationAt" TIMESTAMP WITH TIME ZONE, "lastRefusedRegistrationReason" character varying(100), CONSTRAINT "PK_b24310cc7f12a4385d678d49eea" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_e61bd0e258b87311cc21cbaa95" ON "ResourceAiAgent" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_06d7eb39aceb586c3c5565882b" ON "ResourceAiAgent" ("resourceType") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_b5a1c152c918d42ef96c6a9a1c" ON "ResourceAiAgent" ("resourceId") `,
+    );
+    await queryRunner.query(
+      `CREATE UNIQUE INDEX "IDX_ResourceAiAgent_projectId_resourceType_resourceId" ON "ResourceAiAgent" ("projectId", "resourceType", "resourceId") WHERE "deletedAt" IS NULL`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerHost" ADD "isAiInvestigationEnabled" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerHost" ADD "aiRemediationMode" character varying(100) NOT NULL DEFAULT 'Disabled'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerHost" ADD "aiCommandAllowlist" jsonb`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerHost" ADD "aiAccessLastVerifiedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerHost" ADD "aiAccessLastError" character varying`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerHost" ADD "aiAccessConfiguredAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanHost" ADD "isAiInvestigationEnabled" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanHost" ADD "aiRemediationMode" character varying(100) NOT NULL DEFAULT 'Disabled'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanHost" ADD "aiCommandAllowlist" jsonb`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanHost" ADD "aiAccessLastVerifiedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanHost" ADD "aiAccessLastError" character varying`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanHost" ADD "aiAccessConfiguredAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CephCluster" ADD "isAiInvestigationEnabled" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CephCluster" ADD "aiRemediationMode" character varying(100) NOT NULL DEFAULT 'Disabled'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CephCluster" ADD "aiCommandAllowlist" jsonb`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CephCluster" ADD "aiAccessLastVerifiedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CephCluster" ADD "aiAccessLastError" character varying`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CephCluster" ADD "aiAccessConfiguredAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxCluster" ADD "isAiInvestigationEnabled" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxCluster" ADD "aiRemediationMode" character varying(100) NOT NULL DEFAULT 'Disabled'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxCluster" ADD "aiCommandAllowlist" jsonb`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxCluster" ADD "aiAccessLastVerifiedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxCluster" ADD "aiAccessLastError" character varying`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxCluster" ADD "aiAccessConfiguredAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerSwarmCluster" ADD "isAiInvestigationEnabled" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerSwarmCluster" ADD "aiRemediationMode" character varying(100) NOT NULL DEFAULT 'Disabled'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerSwarmCluster" ADD "aiCommandAllowlist" jsonb`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerSwarmCluster" ADD "aiAccessLastVerifiedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerSwarmCluster" ADD "aiAccessLastError" character varying`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerSwarmCluster" ADD "aiAccessConfiguredAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "VMwareVCenter" ADD "isAiInvestigationEnabled" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "VMwareVCenter" ADD "aiRemediationMode" character varying(100) NOT NULL DEFAULT 'Disabled'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "VMwareVCenter" ADD "aiCommandAllowlist" jsonb`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "VMwareVCenter" ADD "aiAccessLastVerifiedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "VMwareVCenter" ADD "aiAccessLastError" character varying`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "VMwareVCenter" ADD "aiAccessConfiguredAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Host" ADD "isAiInvestigationEnabled" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Host" ADD "aiRemediationMode" character varying(100) NOT NULL DEFAULT 'Disabled'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Host" ADD "aiCommandAllowlist" jsonb`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Host" ADD "aiAccessLastVerifiedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Host" ADD "aiAccessLastError" character varying`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Host" ADD "aiAccessConfiguredAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DatabaseServer" ADD "isAiInvestigationEnabled" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DatabaseServer" ADD "aiRemediationMode" character varying(100) NOT NULL DEFAULT 'Disabled'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DatabaseServer" ADD "aiCommandAllowlist" jsonb`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DatabaseServer" ADD "aiAccessLastVerifiedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DatabaseServer" ADD "aiAccessLastError" character varying`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DatabaseServer" ADD "aiAccessConfiguredAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" ADD "resourceType" character varying(100)`,
+    );
+    await queryRunner.query(`ALTER TABLE "RunnerJob" ADD "resourceId" uuid`);
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" ADD "targetResourceAiAgentId" uuid`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationSuggestion" ADD "resourceType" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationSuggestion" ADD "resourceId" uuid`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_78a02785a95c03f9c7d542f21d" ON "RunnerJob" ("resourceType") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_223854e59d60c3d9ece3cce60a" ON "RunnerJob" ("resourceId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_82b8db95070bbd7b3bbe3fb850" ON "RunnerJob" ("targetResourceAiAgentId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_ebdb04eb0e2b9cbdc7d0b664ff" ON "AutoRemediationSuggestion" ("resourceType") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_2ecbd56658be5035f3bdfe6937" ON "AutoRemediationSuggestion" ("resourceId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ResourceAiAgent" ADD CONSTRAINT "FK_e61bd0e258b87311cc21cbaa95b" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" ADD CONSTRAINT "FK_82b8db95070bbd7b3bbe3fb8509" FOREIGN KEY ("targetResourceAiAgentId") REFERENCES "ResourceAiAgent"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" DROP CONSTRAINT "FK_82b8db95070bbd7b3bbe3fb8509"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ResourceAiAgent" DROP CONSTRAINT "FK_e61bd0e258b87311cc21cbaa95b"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_2ecbd56658be5035f3bdfe6937"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_ebdb04eb0e2b9cbdc7d0b664ff"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_82b8db95070bbd7b3bbe3fb850"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_223854e59d60c3d9ece3cce60a"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_78a02785a95c03f9c7d542f21d"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationSuggestion" DROP COLUMN "resourceId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationSuggestion" DROP COLUMN "resourceType"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" DROP COLUMN "targetResourceAiAgentId"`,
+    );
+    await queryRunner.query(`ALTER TABLE "RunnerJob" DROP COLUMN "resourceId"`);
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" DROP COLUMN "resourceType"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DatabaseServer" DROP COLUMN "aiAccessConfiguredAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DatabaseServer" DROP COLUMN "aiAccessLastError"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DatabaseServer" DROP COLUMN "aiAccessLastVerifiedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DatabaseServer" DROP COLUMN "aiCommandAllowlist"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DatabaseServer" DROP COLUMN "aiRemediationMode"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DatabaseServer" DROP COLUMN "isAiInvestigationEnabled"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Host" DROP COLUMN "aiAccessConfiguredAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Host" DROP COLUMN "aiAccessLastError"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Host" DROP COLUMN "aiAccessLastVerifiedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Host" DROP COLUMN "aiCommandAllowlist"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Host" DROP COLUMN "aiRemediationMode"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Host" DROP COLUMN "isAiInvestigationEnabled"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "VMwareVCenter" DROP COLUMN "aiAccessConfiguredAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "VMwareVCenter" DROP COLUMN "aiAccessLastError"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "VMwareVCenter" DROP COLUMN "aiAccessLastVerifiedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "VMwareVCenter" DROP COLUMN "aiCommandAllowlist"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "VMwareVCenter" DROP COLUMN "aiRemediationMode"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "VMwareVCenter" DROP COLUMN "isAiInvestigationEnabled"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerSwarmCluster" DROP COLUMN "aiAccessConfiguredAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerSwarmCluster" DROP COLUMN "aiAccessLastError"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerSwarmCluster" DROP COLUMN "aiAccessLastVerifiedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerSwarmCluster" DROP COLUMN "aiCommandAllowlist"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerSwarmCluster" DROP COLUMN "aiRemediationMode"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerSwarmCluster" DROP COLUMN "isAiInvestigationEnabled"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxCluster" DROP COLUMN "aiAccessConfiguredAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxCluster" DROP COLUMN "aiAccessLastError"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxCluster" DROP COLUMN "aiAccessLastVerifiedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxCluster" DROP COLUMN "aiCommandAllowlist"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxCluster" DROP COLUMN "aiRemediationMode"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxCluster" DROP COLUMN "isAiInvestigationEnabled"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CephCluster" DROP COLUMN "aiAccessConfiguredAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CephCluster" DROP COLUMN "aiAccessLastError"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CephCluster" DROP COLUMN "aiAccessLastVerifiedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CephCluster" DROP COLUMN "aiCommandAllowlist"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CephCluster" DROP COLUMN "aiRemediationMode"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CephCluster" DROP COLUMN "isAiInvestigationEnabled"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanHost" DROP COLUMN "aiAccessConfiguredAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanHost" DROP COLUMN "aiAccessLastError"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanHost" DROP COLUMN "aiAccessLastVerifiedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanHost" DROP COLUMN "aiCommandAllowlist"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanHost" DROP COLUMN "aiRemediationMode"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanHost" DROP COLUMN "isAiInvestigationEnabled"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerHost" DROP COLUMN "aiAccessConfiguredAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerHost" DROP COLUMN "aiAccessLastError"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerHost" DROP COLUMN "aiAccessLastVerifiedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerHost" DROP COLUMN "aiCommandAllowlist"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerHost" DROP COLUMN "aiRemediationMode"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerHost" DROP COLUMN "isAiInvestigationEnabled"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_ResourceAiAgent_projectId_resourceType_resourceId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_b5a1c152c918d42ef96c6a9a1c"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_06d7eb39aceb586c3c5565882b"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_e61bd0e258b87311cc21cbaa95"`,
+    );
+    await queryRunner.query(`DROP TABLE "ResourceAiAgent"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -23,6 +23,7 @@ import { AddSubscriberNotificationClaimedAt1795900000000 } from "./1795900000000
 import { AddTeamComplianceRuleScope1796000000000 } from "./1796000000000-AddTeamComplianceRuleScope";
 import { AddKubernetesAiAgentAndAiDefaults1796100000000 } from "./1796100000000-AddKubernetesAiAgentAndAiDefaults";
 import { AddProxmoxResourceNativePushColumns1796200000000 } from "./1796200000000-AddProxmoxResourceNativePushColumns";
+import { AddResourceAiAgents1796300000000 } from "./1796300000000-AddResourceAiAgents";
 import { AddConfigurableRuleCriteria1792500000000 } from "./1792500000000-AddConfigurableRuleCriteria";
 import { AddGoogleSecOpsDiagnostics1792300000000 } from "./1792300000000-AddGoogleSecOpsDiagnostics";
 import { AddIncomingCallPolicyPhoneNumbers1792600000000 } from "./1792600000000-AddIncomingCallPolicyPhoneNumbers";
@@ -1246,4 +1247,5 @@ export default [
   AddTeamComplianceRuleScope1796000000000,
   AddKubernetesAiAgentAndAiDefaults1796100000000,
   AddProxmoxResourceNativePushColumns1796200000000,
+  AddResourceAiAgents1796300000000,
 ];

package/Server/Infrastructure/Semaphore.ts

@@ -21,6 +21,20 @@ export default class Semaphore {
     acquireTimeout?: number | undefined;
     acquireAttemptsLimit?: number | undefined;
     retryInterval?: number | undefined;
+    /*
+     * How often a held lock is re-asserted. redis-semaphore defaults to 80%
+     * of lockTimeout, which is also how long `mutex.isAcquired` can go on
+     * reading true after the lock was lost (a Valkey restart, an eviction):
+     * it only changes when a refresh fails. A holder that polls isAcquired
+     * between steps wants this well under lockTimeout.
+     */
+    refreshInterval?: number | undefined;
+    /*
+     * Called when a refresh finds the lock gone. By default redis-semaphore
+     * throws from its refresh timer, which nothing can catch and which ends
+     * up as an unhandled rejection; a long-running holder should pass one.
+     */
+    onLockLost?: ((err: Error) => void) | undefined;
   }): Promise<SemaphoreMutex> {
     if (!data.lockTimeout) {
       data.lockTimeout = 5000;
@@ -52,6 +66,14 @@ export default class Semaphore {
       lockOptions.retryInterval = data.retryInterval;
     }
 
+    if (data.refreshInterval) {
+      lockOptions.refreshInterval = data.refreshInterval;
+    }
+
+    if (data.onLockLost) {
+      lockOptions.onLockLost = data.onLockLost;
+    }
+
     const mutex: SemaphoreMutex = new Mutex(
       client,
       data.namespace + "-" + key,

package/Server/Middleware/TelemetryIngest.ts

@@ -74,8 +74,9 @@ const UNNAMED_SURFACE_READABLE_NAME: string = "this ingest endpoint";
 
 /*
  * The ceiling a server key gets on an identity registration surface
- * (IDENTITY_REGISTRATION_SURFACES: the Kubernetes agent Runner and the
- * Kubernetes AI agent) when its policy names none. Registration is a handful
+ * (IDENTITY_REGISTRATION_SURFACES: the Kubernetes agent Runner, the
+ * Kubernetes AI agent and the resource AI agents) when its policy names
+ * none. Registration is a handful
  * of calls per pod lifetime (start-up, then heartbeats through the minted
  * identity's own key), so a leaked ingestion key hammering it is abuse, not
  * traffic - unlike OTLP ingest, where "no limit" is the historical contract
@@ -90,11 +91,19 @@ export const DEFAULT_KUBERNETES_AGENT_RUNNER_REQUESTS_PER_MINUTE: number =
 /*
  * The refusal a service-pinned key gets on an identity registration surface.
  * Worded for whichever identity the surface mints, and it never names the
- * key, its pinned service or anything else about it.
+ * key, its pinned service or anything else about it. The Kubernetes
+ * surfaces keep their wording exactly; a resource AI agent (Docker, Proxmox,
+ * a database, a host, ...) is told about infrastructure instead.
  */
 export const getPinnedKeyRegistrationRefusalMessage: (
   surface: TelemetryIngestSurface,
 ) => string = (surface: TelemetryIngestSurface): string => {
+  if (surface === TelemetryIngestSurface.ResourceAiAgent) {
+    return `This telemetry ingestion key is pinned to a single service, so it cannot be used for ${getIngestSurfaceReadableName(
+      surface,
+    )}: that grants access to your infrastructure, not to one service's telemetry. Use an unpinned server ingestion key for the AI agent.`;
+  }
+
   return `This telemetry ingestion key is pinned to a single service, so it cannot be used for ${getIngestSurfaceReadableName(
     surface,
   )}: that grants access to a Kubernetes cluster, not to one service's telemetry. Use an unpinned server ingestion key for the Kubernetes agent.`;
@@ -121,8 +130,9 @@ type GetEffectiveRequestsPerMinuteLimitFunction = (
  * did not configure a limit" cannot be allowed to mean "unlimited" there.
  *
  * The one surface-dependent case is identity registration
- * (IDENTITY_REGISTRATION_SURFACES: the Kubernetes agent Runner and the
- * Kubernetes AI agent): a server key with no configured limit is held to a
+ * (IDENTITY_REGISTRATION_SURFACES: the Kubernetes agent Runner, the
+ * Kubernetes AI agent and the resource AI agents): a server key with no
+ * configured limit is held to a
  * conservative default there (see
  * DEFAULT_IDENTITY_REGISTRATION_REQUESTS_PER_MINUTE), because those
  * endpoints mint identities rather than accepting telemetry. Every other

package/Server/Services/AnalyticsDatabaseService.ts

@@ -685,6 +685,16 @@ export default class AnalyticsDatabaseService<
     timestampColumnName: keyof TBaseModel | string;
     startDate: Date;
     endDate: Date;
+    /*
+     * Row names left out of the scan entirely, for a table where OneUptime
+     * writes its own rows under the same (primaryEntityId, primaryEntityType)
+     * as the customer's, so the grouping cannot tell them apart and the
+     * caller's entity-type exclusion cannot either - the session replay
+     * budget series sit next to a RUM application's web vitals (see
+     * TELEMETRY_BILLING_EXCLUDED_METRIC_NAMES). Empty or absent leaves the
+     * statement exactly as it was.
+     */
+    excludeNames?: Array<string> | undefined;
   }): Promise<
     Array<{
       primaryEntityId: string;
@@ -701,6 +711,24 @@ export default class AnalyticsDatabaseService<
       );
     }
 
+    const excludeNames: Array<string> = data.excludeNames || [];
+
+    /*
+     * Names can only be excluded from a table whose `name` is a required
+     * column. Without one ClickHouse fails on the unknown column mid-billing
+     * run; with a Nullable one (Span's), `NULL NOT IN (...)` is not true, so
+     * every unnamed row would silently drop out of the bill. Either way the
+     * caller has a bug, so refuse before the scan.
+     */
+    if (
+      excludeNames.length > 0 &&
+      !this.model.getTableColumn("name")?.required
+    ) {
+      throw new BadDataException(
+        `excludeNames needs a required name column, and ${this.model.tableName} has none`,
+      );
+    }
+
     if (!this.database) {
       this.useDefaultDatabase();
     }
@@ -716,7 +744,23 @@ export default class AnalyticsDatabaseService<
     }} AND ${timestampColumnName} <= ${{
       type: TableColumnType.DateTime64,
       value: data.endDate,
-    }} GROUP BY primaryEntityId, primaryEntityType`;
+    }}`;
+
+    /*
+     * Inside the WHERE, before the grouping, so an excluded row is never
+     * counted or sized. The names travel as one Array(String) parameter,
+     * never as SQL text.
+     */
+    if (excludeNames.length > 0) {
+      statement.append(
+        SQL` AND name NOT IN ${{
+          type: TableColumnType.ArrayText,
+          value: excludeNames,
+        }}`,
+      );
+    }
+
+    statement.append(SQL` GROUP BY primaryEntityId, primaryEntityType`);
 
     /*
      * Billing scan: deliberately NO timeout_overflow_mode='break'. A