actionagent 0.0.0 → 1.2.0

data/app/controllers/action_agent/api/base_controller.rb

@@ -0,0 +1,112 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  module Api
+    # Base class for the dashboard's JSON API — everything the React
+    # dashboard reads and writes.
+    #
+    # Authentication is the host app's (ActionAgent
+    # .authentication_method), and so is ownership: `owned` scopes any
+    # dashboard relation to the signed-in user or account depending on what
+    # the model declared with `owned_by`, which is how a single-user
+    # install, a per-user install and a multi-tenant platform all read the
+    # same controllers.
+    #
+    # Note this is not the telemetry ingest endpoint — that authenticates
+    # with a bearer token and lives in Api::TracesController.
+    class BaseController < ActionAgent::ApplicationController
+      skip_forgery_protection
+
+      rescue_from ActiveRecord::RecordNotFound, with: :not_found
+      rescue_from ActiveRecord::RecordInvalid, with: :unprocessable_entity
+      rescue_from ActionController::ParameterMissing, with: :bad_request
+
+      private
+
+      # Scopes +relation+ to the caller, following the model's own
+      # declaration. Unowned models (a single-user install, or a model that
+      # nothing owns) come back unfiltered.
+      # An unresolved owner scopes to nothing rather than to
+      # `where(id: nil)`, which would match every unowned row and leak them
+      # across tenants.
+      def owned(relation)
+        klass = relation.respond_to?(:klass) ? relation.klass : relation
+
+        case klass.owner_association
+        when :account then current_account ? relation.where(account_id: current_account.id) : relation.none
+        when :user then current_user ? relation.where(user_id: current_user.id) : relation.none
+        else relation.all
+        end
+      end
+
+      # The agents the caller can see. Not simply `owned(Agent)`: a host
+      # app can define reachability more broadly than ownership (an
+      # account's key reaching every member's agents, say).
+      def owner_agents
+        ActionAgent.agents_for(current_owner)
+      end
+
+      # Reported traces visible to the caller. Scoped to the tenant in a
+      # multi-tenant install; every trace otherwise.
+      def owned_traces
+        ActionAgent.trace_model.for_account(current_account)
+      end
+
+      # The tenant, when the host app has one. current_owner already
+      # resolves it in multi-tenant mode; single-tenant installs have none.
+      def current_account
+        ActionAgent.multi_tenant? ? current_owner : nil
+      end
+
+      # Refuses the request when a multi-tenant install can't resolve a
+      # tenant. Single-tenant installs have nothing to check.
+      def require_owner!
+        return unless ActionAgent.multi_tenant?
+        return if current_owner.present?
+
+        render json: { error: "No account" }, status: :unauthorized
+      end
+
+      # Asks the host app whether this owner may do +kind+ (:execution or
+      # :trace_ingest). Unlimited unless the app said otherwise.
+      def enforce_quota!(kind)
+        denial = ActionAgent.quota_denial(current_owner, kind)
+        return if denial.blank?
+
+        body = { error: "Plan limit reached", upgrade_required: true }
+        # A checker can answer with a message, or with a hash carrying
+        # whatever else the host app wants the client to see (its own usage
+        # numbers, an upgrade link).
+        body = denial.is_a?(Hash) ? body.merge(denial) : body.merge(message: denial)
+
+        render json: body, status: :payment_required
+      end
+
+      def enforce_execution_quota! = enforce_quota!(:execution)
+
+      def record_execution_usage
+        ActionAgent.record_usage(current_owner, :execution)
+      end
+
+      # Execution can be turned off entirely, leaving a read-only
+      # observability dashboard.
+      def require_execution_enabled!
+        return if ActionAgent.execution_enabled?
+
+        render json: { error: "Agent execution is disabled on this dashboard" }, status: :forbidden
+      end
+
+      def not_found
+        render json: { error: "Record not found" }, status: :not_found
+      end
+
+      def unprocessable_entity(exception)
+        render json: { error: exception.record.errors.full_messages }, status: :unprocessable_entity
+      end
+
+      def bad_request(exception)
+        render json: { error: exception.message }, status: :bad_request
+      end
+    end
+  end
+end

data/app/controllers/action_agent/api/evaluations_controller.rb

@@ -0,0 +1,148 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  module Api
+    # CRUD + execution for agent evaluations, backing the dashboard
+    # Evaluations view. Scoped to the current user's agents.
+    class EvaluationsController < BaseController
+      before_action :require_owner!
+
+      # Default criteria used when none are supplied — all rule-based, so a
+      # new evaluation produces real scores without provider credentials.
+      DEFAULT_CRITERIA = [
+        { "key" => "response_present", "type" => "response_present", "config" => {} },
+        { "key" => "response_length", "type" => "min_length", "config" => { "chars" => 40 } },
+        { "key" => "latency", "type" => "max_latency_ms", "config" => { "ms" => 5000 } },
+        { "key" => "token_budget", "type" => "token_budget", "config" => { "output_tokens" => 1000 } }
+      ].freeze
+
+      # GET /api/evaluations
+      # agent_id scopes to one agent. The filter has to happen before the limit:
+      # the agent page reads this endpoint, and filtering an account-wide page of
+      # 50 client-side hides an agent whose evaluations are not among the account's
+      # 50 most recent. The scope is already restricted to the current user's
+      # agents, so an id outside it simply returns nothing.
+      def index
+        scope = evaluations_scope
+        scope = scope.where(agent_id: params[:agent_id]) if params[:agent_id].present?
+        evaluations = scope.includes(:agent, :evaluation_runs).recent.limit(50)
+
+        render json: { evaluations: evaluations.map { |evaluation| serialize(evaluation) } }
+      end
+
+      # GET /api/evaluations/:id
+      def show
+        evaluation = evaluations_scope.find(params[:id])
+
+        render json: {
+          evaluation: serialize(evaluation).merge(
+            runs: evaluation.evaluation_runs.recent.limit(20).map { |run| serialize_run(run) }
+          )
+        }
+      end
+
+      # POST /api/evaluations
+      def create
+        agent = owner_agents.find(params.require(:evaluation)[:agent_id])
+
+        judge_kind = evaluation_params[:judge_kind].presence || "rules"
+        config = {}
+        config["compare_models"] = compare_models_param if compare_models_param.any?
+
+        evaluation = agent.evaluations.new(
+          name: evaluation_params[:name],
+          judge_kind: judge_kind,
+          judge_model: evaluation_params[:judge_model],
+          sample_size: evaluation_params[:sample_size].presence || 20,
+          # judge_defined starts with no criteria — the judge authors the
+          # KPIs on the first run.
+          criteria: judge_kind == "judge_defined" ? explicit_criteria : normalized_criteria,
+          config: config
+        )
+
+        if evaluation.save
+          evaluation.run!
+          render json: { evaluation: serialize(evaluation.reload) }, status: :created
+        else
+          render json: { errors: evaluation.errors.full_messages }, status: :unprocessable_entity
+        end
+      end
+
+      # POST /api/evaluations/:id/run
+      def run
+        evaluation = evaluations_scope.find(params[:id])
+        run = evaluation.run!
+
+        render json: { evaluation: serialize(evaluation.reload), run: serialize_run(run) }
+      end
+
+      # DELETE /api/evaluations/:id
+      def destroy
+        evaluations_scope.find(params[:id]).destroy!
+        head :no_content
+      end
+
+      private
+
+      def evaluations_scope
+        Evaluation.joins(:agent).where(agent: owner_agents)
+      end
+
+      def evaluation_params
+        params.require(:evaluation).permit(:agent_id, :name, :judge_kind, :judge_model, :sample_size)
+      end
+
+      def normalized_criteria
+        explicit_criteria.presence || DEFAULT_CRITERIA.deep_dup
+      end
+
+      def explicit_criteria
+        raw = params[:evaluation][:criteria]
+        return [] if raw.blank?
+
+        raw.map do |criterion|
+          criterion.permit(:key, :type, config: {}).to_h.tap do |c|
+            c["key"] = c["key"].presence || c["type"]
+            c["config"] ||= {}
+          end
+        end
+      end
+
+      def compare_models_param
+        Array(params[:evaluation][:compare_models]).map(&:to_s).reject(&:blank?)
+      end
+
+      def serialize(evaluation)
+        latest = evaluation.latest_run
+
+        {
+          id: evaluation.id,
+          name: evaluation.name,
+          agent: { id: evaluation.agent.id, name: evaluation.agent.name, slug: evaluation.agent.slug },
+          judge_kind: evaluation.judge_kind,
+          judge_model: evaluation.judge_model,
+          criteria: evaluation.criteria,
+          compare_models: evaluation.compare_models,
+          config: evaluation.config,
+          sample_size: evaluation.sample_size,
+          created_at: evaluation.created_at.iso8601,
+          latest_run: latest ? serialize_run(latest) : nil
+        }
+      end
+
+      def serialize_run(run)
+        {
+          id: run.id,
+          status: run.status,
+          scores: run.scores,
+          average_score: run.average_score,
+          samples_evaluated: run.samples_evaluated,
+          samples_passed: run.samples_passed,
+          error_message: run.error_message,
+          completed_at: run.completed_at&.iso8601,
+          created_at: run.created_at.iso8601
+        }
+      end
+    end
+  end
+end

data/app/controllers/action_agent/api/instance_tiers_controller.rb

@@ -0,0 +1,106 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  module Api
+    class InstanceTiersController < ApplicationController
+      before_action :set_tier, only: [ :show ]
+
+      # GET /api/instance_tiers
+      # List all available instance tiers
+      def index
+        tiers = SandboxInstanceTier.available
+
+        # Filter by category if provided
+        if params[:category].present?
+          tiers = tiers.select { |t| t.category == params[:category] }
+        end
+
+        # Filter by GPU if requested
+        if params[:gpu] == "true"
+          tiers = tiers.select(&:has_gpu?)
+        elsif params[:gpu] == "false"
+          tiers = tiers.reject(&:has_gpu?)
+        end
+
+        render json: {
+          tiers: tiers.map(&:as_json),
+          categories: [
+            { id: "free", name: "Free", description: "Basic instances for testing" },
+            { id: "pro", name: "Pro", description: "Standard instances for production" },
+            { id: "enterprise", name: "Enterprise", description: "High-performance instances" }
+          ]
+        }
+      end
+
+      # GET /api/instance_tiers/:id
+      # Get a specific instance tier
+      def show
+        render json: { tier: @tier.as_json }
+      end
+
+      # GET /api/instance_tiers/recommend
+      # Get recommended tier for a sandbox type
+      def recommend
+        sandbox_type = params[:sandbox_type] || "default"
+
+        recommended = case sandbox_type
+        when "playwright_mcp"
+          SandboxInstanceTier.find(:cpu_medium)
+        when "research"
+          SandboxInstanceTier.find(:cpu_small)
+        when "terminal"
+          SandboxInstanceTier.find(:free)
+        else
+          SandboxInstanceTier.find(:cpu_small)
+        end
+
+        alternatives = SandboxInstanceTier.available.reject { |t| t.id == recommended.id }.take(3)
+
+        render json: {
+          recommended: recommended.as_json,
+          alternatives: alternatives.map(&:as_json),
+          sandbox_type: sandbox_type
+        }
+      end
+
+      # GET /api/instance_tiers/pricing
+      # Get pricing comparison
+      def pricing
+        tiers = SandboxInstanceTier.available
+
+        render json: {
+          cpu_tiers: tiers.select { |t| !t.has_gpu? }.map { |t|
+            {
+              id: t.id,
+              name: t.name,
+              specs: t.display_specs,
+              hourly: t.hourly_cost.to_f,
+              monthly: t.monthly_cost.to_f,
+              category: t.category
+            }
+          },
+          gpu_tiers: tiers.select(&:has_gpu?).map { |t|
+            {
+              id: t.id,
+              name: t.name,
+              specs: t.display_specs,
+              hourly: t.hourly_cost.to_f,
+              monthly: t.monthly_cost.to_f,
+              category: t.category
+            }
+          },
+          currency: "USD",
+          billing_increment: "per second"
+        }
+      end
+
+      private
+
+      def set_tier
+        @tier = SandboxInstanceTier.find(params[:id])
+      rescue ArgumentError => e
+        render json: { error: "Tier not found: #{params[:id]}" }, status: :not_found
+      end
+    end
+  end
+end

data/app/controllers/action_agent/api/interactions_controller.rb

@@ -0,0 +1,197 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  module Api
+    # Read API for agent conversation contexts (solid_agent persistence),
+    # backing the dashboard Interactions view.
+    #
+    # A context is one agent's interaction stream (AgentContext +
+    # AgentMessages + AgentGenerations, recorded by SolidAgent::HasContext
+    # during execution), scoped to the current user's agents.
+    class InteractionsController < BaseController
+      before_action :require_owner!
+
+      DEFAULT_LIMIT = 50
+      MAX_WINDOW_MINUTES = 60 * 24 * 90
+
+      # GET /api/interactions
+      def index
+        limit = params.fetch(:limit, DEFAULT_LIMIT).to_i.clamp(1, 200)
+
+        contexts = interactions_scope
+          .includes(:contextable)
+          .then { |scope| window_minutes ? scope.where(updated_at: window_minutes.minutes.ago..) : scope }
+          .recent
+          .limit(limit)
+
+        message_counts = AgentMessage.where(agent_context_id: contexts.map(&:id)).group(:agent_context_id).count
+        generation_counts = AgentGeneration.where(agent_context_id: contexts.map(&:id)).group(:agent_context_id).count
+        # Latest model per context, so list rows can gauge context-window
+        # pressure without loading generations.
+        # DISTINCT ON would do this in one pass on PostgreSQL but has no
+        # portable equivalent, so take the newest generation id per context
+        # (they are only ever appended) and read those rows.
+        newest_ids = AgentGeneration
+          .where(agent_context_id: contexts.map(&:id))
+          .group(:agent_context_id)
+          .maximum(:id)
+        latest_models = AgentGeneration.where(id: newest_ids.values)
+          .pluck(:agent_context_id, :model).to_h
+
+        previews = message_previews(contexts.map(&:id))
+
+        persisted = contexts.map do |context|
+          serialize_context(context).merge(
+            source: "platform",
+            model: latest_models[context.id],
+            message_count: message_counts[context.id] || 0,
+            generation_count: generation_counts[context.id] || 0,
+            preview: previews[context.id] || { input: nil, output: nil }
+          )
+        end
+
+        reported = reported_traces(limit).map { |trace| TraceInteractionSerializer.summary(trace) }
+
+        render json: {
+          interactions: (persisted + reported).sort_by { |row| row[:last_activity_at].to_s }.reverse.first(limit)
+        }
+      end
+
+      # GET /api/interactions/:id
+      def show
+        if (trace_id = params[:id].to_s[/\Atrace-(\d+)\z/, 1])
+          trace = owned_traces.find(trace_id)
+          return render json: { interaction: TraceInteractionSerializer.detail(trace) }
+        end
+
+        context = interactions_scope.find(params[:id])
+
+        render json: {
+          interaction: serialize_context(context).merge(
+            source: "platform",
+            instructions: context.instructions,
+            messages: context.messages.chronological.map { |message| serialize_message(message) },
+            generations: context.generations.order(created_at: :asc).map { |generation| serialize_generation(generation) }
+          )
+        }
+      end
+
+      private
+
+      # What each stream opened with and what it finally answered, so a
+      # collapsed interaction row says what it was about — the same two lines a
+      # collapsed trace row shows. Two grouped queries rather than loading
+      # every message: the list is fifty streams deep and only needs the ends
+      # of each.
+      def message_previews(context_ids)
+        return {} if context_ids.empty?
+
+        first_input = edge_messages(context_ids, "user", :minimum)
+        last_output = edge_messages(context_ids, "assistant", :maximum)
+
+        context_ids.index_with do |id|
+          {
+            input: InteractionPreview.line(first_input[id]),
+            output: InteractionPreview.line(last_output[id])
+          }
+        end
+      end
+
+      # The first or last message of a role per context. Messages are only ever
+      # appended, so the smallest and largest ids are the ends of the stream —
+      # which is the portable form of the DISTINCT ON this would be on
+      # PostgreSQL, and the same shape the latest-model lookup above uses.
+      def edge_messages(context_ids, role, edge)
+        scope = AgentMessage
+          .where(agent_context_id: context_ids, role: role)
+          .where.not(content: [ nil, "" ])
+
+        ids = scope.group(:agent_context_id).public_send(edge, :id)
+        AgentMessage.where(id: ids.values).pluck(:agent_context_id, :content).to_h
+      end
+
+      # Agents executing outside the platform never write solid_agent contexts —
+      # they only report traces. Every reported trace is an interaction: one run
+      # of one agent. Traces without captured content still show their tool calls,
+      # timings, and generation metadata, so filtering on the presence of a
+      # prompt would hide most runs (locally: 9 of 11) and make the per-agent
+      # counts disagree with Traces for the same window.
+      def reported_traces(limit)
+        scope = owned_traces.where.not(agent_class: nil)
+        scope = scope.where(timestamp: window_minutes.minutes.ago..) if window_minutes
+        # Honor the agent filter the persisted side already applies: without
+        # this, a per-agent view listed every agent's reported traffic, and an
+        # agent whose traces are all SDK-reported showed nothing of its own.
+        scope = scope.merge(traces_for_agent(params[:agent_id])) if params[:agent_id].present?
+        scope.order(timestamp: :desc).limit(limit)
+      end
+
+      # Traces belong to an agent by foreign key once AgentRegistrar attributes
+      # them; older rows predate that, so fall back to the class name.
+      def traces_for_agent(agent_id)
+        agent = owner_agents.find_by(id: agent_id)
+        return ActionAgent.trace_model.none unless agent
+
+        ActionAgent.trace_model.where(agent_id: agent.id)
+          .or(ActionAgent.trace_model.where(agent_id: nil, agent_class: agent.telemetry_agent_class))
+      end
+
+      # The dashboard-wide time window, shared with Traces. Absent means "all".
+      def window_minutes
+        return @window_minutes if defined?(@window_minutes)
+
+        raw = params[:minutes].presence
+        @window_minutes = raw ? raw.to_i.clamp(1, MAX_WINDOW_MINUTES) : nil
+      end
+
+      def interactions_scope
+        agents = owner_agents
+        agents = agents.where(id: params[:agent_id]) if params[:agent_id].present?
+        AgentContext.for_agents(agents)
+      end
+
+      def serialize_context(context)
+        agent = context.contextable
+        {
+          id: context.id,
+          agent_name: context.agent_name,
+          action_name: context.action_name,
+          display_name: "#{context.agent_name}##{context.action_name}",
+          agent: agent.is_a?(Agent) ? { id: agent.id, name: agent.name, slug: agent.slug } : nil,
+          tokens: {
+            input: context.total_input_tokens,
+            output: context.total_output_tokens,
+            total: context.total_tokens
+          },
+          created_at: context.created_at.iso8601,
+          last_activity_at: context.updated_at.iso8601
+        }
+      end
+
+      def serialize_message(message)
+        AgentMessageSerializer.call(message)
+      end
+
+      def serialize_generation(generation)
+        {
+          id: generation.id,
+          model: generation.model,
+          provider: generation.provider,
+          finish_reason: generation.finish_reason,
+          tokens: {
+            input: generation.input_tokens,
+            output: generation.output_tokens,
+            total: generation.total_tokens,
+            cached: generation.cached_tokens,
+            thinking: generation.reasoning_tokens
+          },
+          cache_hit: generation.cache_hit?,
+          thinking: generation.thinking?,
+          duration_seconds: generation.duration_seconds,
+          trace_id: generation.trace_id,
+          created_at: generation.created_at.iso8601(3)
+        }
+      end
+    end
+  end
+end