Make the discovery abstention message name the real cause, not a wrong fix

The metadata-only abstention is only reached when command scanning is already
enabled but the host agent returned no command output. The old reason text told
the user to 'Enable Pulse Commands' — a toggle that is provably already on when
this message appears — so the guidance was self-contradictory. The reason now
states commands are enabled and points at the actual gap: confirm the host
agent is connected and its API token has the agent:exec scope.
This commit is contained in:
rcourtman 2026-06-09 16:35:00 +01:00
parent cfd7775a95
commit 2b521431be

View file

@ -2778,9 +2778,15 @@ func resourceIdentityNeedsCommandEvidence(rt ResourceType) bool {
// instead of a fabricated guess. CLIAccess is left empty so the platform-correct
// access command is generated downstream rather than invented by the model.
func metadataOnlyDiscoveryAbstention() *AIAnalysisResponse {
// This abstention is only reached when command scanning is already enabled
// (see commandScanAttempted in DiscoverResource) but the host agent returned
// no command output — so the honest cause is the agent not being reachable
// for execution, NOT a disabled "Pulse Commands" toggle. Do not tell the user
// to enable something that is already on; point them at agent connectivity and
// the agent:exec token scope instead.
return &AIAnalysisResponse{
Confidence: 0,
Reasoning: "Discovery could not run commands on this resource, so its service was not identified. Enable \"Pulse Commands\" for the host agent (Settings → Infrastructure) to run real discovery instead of guessing.",
Reasoning: "Discovery couldn't collect command output from inside this resource, so its service wasn't identified. Pulse Commands are enabled, but the host agent returned no results — make sure the host agent is connected and its API token has the \"agent:exec\" scope.",
}
}