actionagent 0.0.0 → 1.2.0

data/app/controllers/action_agent/api/mcp_controller.rb

@@ -0,0 +1,218 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  module Api
+    # Exposes the dashboard's agents as an authenticated MCP (Model Context
+    # Protocol) service over Streamable HTTP JSON-RPC — agents present
+    # themselves as Resource Agents backed by their ActiveRecord state:
+    #
+    # - tools/list & tools/call: each agent is a callable tool (run_<slug>)
+    #   that executes a synchronous generation run.
+    # - resources/list & resources/read: each agent is an agent://<slug>
+    #   resource whose content is its live scorecard (config + stats + memory
+    #   summary from the solid_agent datasets).
+    #
+    # Authentication/authorization: Bearer <api key> (Settings -> API Keys).
+    # The key scopes everything to its account — its members' agents and its
+    # run quotas.
+    #
+    # Connect from an MCP client with:
+    #   { "type": "http", "url": "https://activeagents.ai/mcp",
+    #     "headers": { "Authorization": "Bearer aa_..." } }
+    class McpController < BaseController
+      # Authenticated by API key rather than by the host app's sessions.
+      allow_unauthenticated_access
+      before_action :authenticate_api_key!
+
+      PROTOCOL_VERSION = "2025-03-26"
+      JSONRPC_METHOD_NOT_FOUND = -32601
+      JSONRPC_INVALID_PARAMS = -32602
+      JSONRPC_SERVER_ERROR = -32000
+
+      # POST /mcp
+      def create
+        request_id = params[:id]
+
+        # JSON-RPC notifications get no response body.
+        return head :accepted if request_id.nil? && params[:method].to_s.start_with?("notifications/")
+
+        result = case params[:method]
+        when "initialize" then initialize_result
+        when "ping" then {}
+        when "tools/list" then tools_list
+        when "tools/call" then tools_call
+        when "resources/list" then resources_list
+        when "resources/read" then resources_read
+        else
+          return render_error(request_id, JSONRPC_METHOD_NOT_FOUND, "Method not found: #{params[:method]}")
+        end
+
+        render json: { jsonrpc: "2.0", id: request_id, result: result }
+      rescue McpError => e
+        render_error(request_id, e.code, e.message)
+      rescue StandardError => e
+        Rails.logger.error("[Api::McpController] #{e.class}: #{e.message}")
+        render_error(request_id, JSONRPC_SERVER_ERROR, "Internal error")
+      end
+
+      private
+
+      # JSON-RPC errors ride on HTTP 200 per the MCP Streamable HTTP transport.
+      def render_error(id, code, message)
+        render json: { jsonrpc: "2.0", id: id, error: { code: code, message: message } }
+      end
+
+      class McpError < StandardError
+        attr_reader :code
+
+        def initialize(message, code = JSONRPC_SERVER_ERROR)
+          super(message)
+          @code = code
+        end
+      end
+
+      def authenticate_api_key!
+        token = request.headers["Authorization"].to_s[/\ABearer\s+(.+)\z/i, 1]
+        api_key = ApiKey.authenticate(token)
+
+        if api_key.nil?
+          render json: { error: "Unauthorized: pass a dashboard API key as a Bearer token" }, status: :unauthorized
+          return
+        end
+
+        api_key.touch_last_used!
+        @api_key = api_key
+        @owner = api_key.owner
+      end
+
+      # The agents this key can reach. A key belongs to whoever owns it, and
+      # a single-user install has no owner, so the key reaches every agent
+      # the dashboard holds.
+      def key_agents
+        ActionAgent.agents_for(@owner).where.not(status: :archived).order(:slug)
+      end
+
+      def initialize_result
+        {
+          protocolVersion: PROTOCOL_VERSION,
+          capabilities: { tools: {}, resources: {} },
+          serverInfo: { name: "activeagents", version: "1.0" },
+          instructions: "Each tool runs one of this account's agents. Each agent://<slug> resource returns the agent's live scorecard."
+        }
+      end
+
+      MESSAGE_INPUT_SCHEMA = {
+        type: "object",
+        properties: {
+          message: { type: "string", description: "The prompt/message for the agent" }
+        },
+        required: [ "message" ]
+      }.freeze
+
+      def tools_list
+        tools = key_agents.flat_map do |agent|
+          agent_tools = [ {
+            name: "run_#{agent.slug}",
+            description: agent.description.presence || "Run the #{agent.name} agent",
+            inputSchema: MESSAGE_INPUT_SCHEMA
+          } ]
+          # Named actions marked expose_as_tool are individually callable —
+          # the activeagent "actions as tools" pattern over MCP.
+          Array(agent.action_prompts).select { |ap| ap["expose_as_tool"] }.each do |action|
+            agent_tools << {
+              name: "run_#{agent.slug}__#{action['name']}",
+              description: "Run the #{agent.name} agent's #{action['name']} action",
+              inputSchema: MESSAGE_INPUT_SCHEMA
+            }
+          end
+          agent_tools
+        end
+
+        { tools: tools }
+      end
+
+      def tools_call
+        name = params.dig(:params, :name).to_s
+        slug, action = name.delete_prefix("run_").split("__", 2)
+        agent = key_agents.find_by(slug: slug)
+        raise McpError.new("Unknown tool: #{name}", JSONRPC_INVALID_PARAMS) unless agent
+        if action.present? && agent.action_prompt_for(action)&.dig("expose_as_tool") != true
+          raise McpError.new("Unknown tool: #{name}", JSONRPC_INVALID_PARAMS)
+        end
+
+        message = params.dig(:params, :arguments, :message).to_s
+        raise McpError.new("Missing required argument: message", JSONRPC_INVALID_PARAMS) if message.blank?
+
+        unless ActionAgent.execution_enabled?
+          raise McpError.new("Agent execution is disabled on this dashboard")
+        end
+        if (denial = ActionAgent.quota_denial(@owner, :execution)).present?
+          raise McpError.new(denial.is_a?(Hash) ? denial[:message] || denial["message"] : denial)
+        end
+
+        run = agent.test_execute(message, action: action)
+        ActionAgent.record_usage(@owner, :execution)
+
+        if run.failed?
+          { content: [ { type: "text", text: "Agent run failed: #{run.error_message}" } ], isError: true }
+        else
+          {
+            content: [ { type: "text", text: run.output.to_s } ],
+            structuredContent: {
+              run_id: run.id,
+              trace_id: run.trace_id,
+              duration_ms: run.duration_ms,
+              total_tokens: run.total_tokens,
+              metadata: run.output_metadata
+            }
+          }
+        end
+      end
+
+      def resources_list
+        {
+          resources: key_agents.map do |agent|
+            {
+              uri: "agent://#{agent.slug}",
+              name: agent.name,
+              description: agent.description.presence || "#{agent.name} scorecard",
+              mimeType: "application/json"
+            }
+          end
+        }
+      end
+
+      def resources_read
+        uri = params.dig(:params, :uri).to_s
+        slug = uri.delete_prefix("agent://")
+        agent = key_agents.find_by(slug: slug)
+        raise McpError.new("Unknown resource: #{uri}", JSONRPC_INVALID_PARAMS) unless agent
+
+        {
+          contents: [ {
+            uri: uri,
+            mimeType: "application/json",
+            text: agent_resource(agent).to_json
+          } ]
+        }
+      end
+
+      # The Resource Agent card: configuration plus live scorecard stats and
+      # the agent's memory summary (solid_agent datasets).
+      def agent_resource(agent)
+        {
+          name: agent.name,
+          slug: agent.slug,
+          description: agent.description,
+          provider: agent.provider,
+          model: agent.model,
+          status: agent.status,
+          tools: agent.tools,
+          instructions: agent.instructions,
+          stats: AgentScorecard.for_agents([ agent ])[agent.id],
+          memory: agent.memory.summary_list.last(20)
+        }
+      end
+    end
+  end
+end

data/app/controllers/action_agent/api/mcp_servers_controller.rb

@@ -0,0 +1,156 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  module Api
+    # Read API for MCP services, plus sandbox provisioning for the servers
+    # that can be started on demand. Backs the dashboard MCP Services view.
+    #
+    # The list is the union of three things: servers detected from telemetry
+    # and solid_agent records (ToolDiscovery), servers an agent declares in
+    # its configuration, and the default catalog (McpCatalog). An install
+    # therefore sees both what it is already using and what it could turn on.
+    class McpServersController < BaseController
+      before_action :require_owner!
+      # Launching provisions a sandbox and runs a server in it, so it answers
+      # to the same two gates as any other execution: the read-only kill
+      # switch, and whatever limits the host app imposes.
+      before_action :require_execution_enabled!, only: [ :launch ]
+      before_action :enforce_execution_quota!, only: [ :launch ]
+      before_action :set_catalog_entry, only: [ :show, :launch ]
+
+      STATUS_LABELS = {
+        "active" => "Called in this window",
+        "configured" => "Declared by an agent, no traffic yet",
+        "available" => "Available to connect",
+        "idle" => "Seen previously, no traffic in this window"
+      }.freeze
+
+      # GET /api/mcp_servers
+      def index
+        finder = discovery
+        tools = finder.detected_tools
+        servers = finder.servers(tools)
+
+        render json: {
+          servers: servers,
+          catalog: McpCatalog.all,
+          summary: summary_for(servers),
+          sandboxes: active_sandboxes,
+          window_hours: finder.window_hours,
+          statuses: STATUS_LABELS
+        }
+      end
+
+      # GET /api/mcp_servers/:id
+      #
+      # One server with the tools detected for it, so the view can expand a
+      # row without refetching the whole inventory.
+      def show
+        finder = discovery
+        tools = finder.detected_tools
+        server = finder.servers(tools).find { |row| row[:key] == params[:id] }
+
+        render json: {
+          server: server || @catalog_entry,
+          tools: tools.select { |tool| tool[:mcp_server] == params[:id] }
+        }
+      end
+
+      # POST /api/mcp_servers/:id/launch
+      #
+      # Starts the server inside a sandbox session. Only catalog entries
+      # marked +sandbox: true+ are launchable — the rest need credentials
+      # the dashboard has nowhere safe to source, so they are listed but not
+      # startable.
+      def launch
+        unless @catalog_entry[:sandbox]
+          return render json: {
+            error: "#{@catalog_entry[:name]} can't be started from the dashboard",
+            reason: launch_blocked_reason(@catalog_entry)
+          }, status: :unprocessable_entity
+        end
+
+        sandbox = SandboxSession.new(
+          sandbox_type: @catalog_entry[:sandbox_type] || "terminal",
+          mcp_servers: [ @catalog_entry[:key] ]
+        )
+        # A sandbox belongs to whoever opened it, which is how
+        # SandboxesController assigns them too — not to whatever
+        # `current_owner` resolves to, since that is the account in a
+        # multi-tenant install and this model prefers :user. Both are set
+        # when the host app has them; a single-user install declares neither
+        # association, so both are skipped.
+        # respond_to? alone isn't enough: the association is declared from
+        # configuration, but a host app's pre-existing table may not carry
+        # the column behind it.
+        assign_owner(sandbox, :user, current_user)
+        assign_owner(sandbox, :account, current_account)
+
+        if sandbox.save
+          sandbox.provision!
+          sandbox.reload
+          record_execution_usage
+          render json: { sandbox: sandbox.summary, server: @catalog_entry }, status: :created
+        else
+          render json: { error: sandbox.errors.full_messages }, status: :unprocessable_entity
+        end
+      end
+
+      private
+
+      def discovery
+        ToolDiscovery.new(traces: owned_traces, agents: owner_agents, hours: window_hours)
+      end
+
+      def assign_owner(sandbox, association, record)
+        return if record.nil?
+        return unless sandbox.respond_to?(:"#{association}=")
+        return unless sandbox.has_attribute?(:"#{association}_id")
+
+        sandbox.public_send(:"#{association}=", record)
+      end
+
+      def set_catalog_entry
+        @catalog_entry = McpCatalog.find(params[:id])
+        render json: { error: "Unknown MCP server: #{params[:id]}" }, status: :not_found if @catalog_entry.nil?
+      end
+
+      def launch_blocked_reason(entry)
+        if entry[:requires_credentials].any?
+          "Needs #{entry[:requires_credentials].to_sentence}. Configure it on an agent instead."
+        else
+          "This server runs outside the sandbox environment."
+        end
+      end
+
+      def summary_for(servers)
+        {
+          total: servers.size,
+          active: servers.count { |server| server[:status] == "active" },
+          configured: servers.count { |server| server[:status] == "configured" },
+          available: servers.count { |server| server[:status] == "available" },
+          launchable: servers.count { |server| server[:launchable] },
+          # Servers seen in traffic that the catalog doesn't describe — worth
+          # surfacing, since they're the ones nobody documented.
+          unknown: servers.count { |server| !server[:known] },
+          total_calls: servers.sum { |server| server[:calls] }
+        }
+      end
+
+      # Running sandboxes started with an MCP server, so the view can show
+      # "running" beside the launch button instead of starting a second copy.
+      def active_sandboxes
+        owned(SandboxSession)
+          .active
+          .where(SandboxSession.json_array_not_empty_sql(:mcp_servers))
+          .recent
+          .limit(20)
+          .map { |sandbox| sandbox.summary.merge(mcp_servers: Array(sandbox.mcp_servers)) }
+      end
+
+      def window_hours
+        params.fetch(:hours, ToolDiscovery::DEFAULT_WINDOW_HOURS).to_i
+      end
+    end
+  end
+end

data/app/controllers/action_agent/api/metrics_controller.rb

@@ -0,0 +1,178 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  module Api
+    # Read API for telemetry metrics, backing the dashboard Metrics view.
+    #
+    # Exposes the same aggregates as the gem dashboard's metrics page
+    # (ActionAgent::TracesController#metrics / #calculate_metrics /
+    # #agent_statistics): trace counts, token totals, average duration, error
+    # rate, active agents and per-agent statistics — account-scoped, plus
+    # previous-period deltas for trend indicators.
+    class MetricsController < BaseController
+      before_action :require_owner!
+
+      DEFAULT_WINDOW_HOURS = 24
+      MAX_WINDOW_HOURS = 24 * 30
+
+      # How to rank the per-agent table. Cost is applied after the grouped
+      # query because pricing happens in Ruby (rates vary per model), so all
+      # four are ordered in one place rather than half in SQL.
+      AGENT_SORTS = {
+        "popular" => "Most requests",
+        "longest" => "Longest average",
+        "cost" => "Highest cost",
+        "tokens" => "Most tokens",
+        "errors" => "Most errors"
+      }.freeze
+      DEFAULT_AGENT_SORT = "popular"
+
+      # GET /api/metrics
+      def show
+        hours = params.fetch(:hours, DEFAULT_WINDOW_HOURS).to_i.clamp(1, MAX_WINDOW_HOURS)
+        now = Time.current
+
+        current = traces_scope.for_date_range(hours.hours.ago(now), now)
+        previous = traces_scope.for_date_range((hours * 2).hours.ago(now), hours.hours.ago(now))
+
+        costs = cost_statistics(current)
+        priced = agent_statistics(current).map { |row| row.merge(cost: costs[:by_agent][row[:name]] || 0.0) }
+
+        render json: {
+          summary: summary_for(current, previous).merge(total_cost: costs[:total]),
+          hourly_requests: hourly_requests(current, hours, now),
+          by_agent: sort_agents(priced, params[:sort]),
+          window_hours: hours,
+          sorts: AGENT_SORTS,
+          sort: agent_sort(params[:sort])
+        }
+      end
+
+      private
+
+      def agent_sort(requested)
+        AGENT_SORTS.key?(requested.to_s) ? requested.to_s : DEFAULT_AGENT_SORT
+      end
+
+      # Descending on the chosen dimension; request count breaks ties so the
+      # table keeps a stable, meaningful secondary order.
+      def sort_agents(rows, requested)
+        key = case agent_sort(requested)
+        when "longest" then :avg_duration_ms
+        when "cost" then :cost
+        when "tokens" then :tokens
+        when "errors" then :errors
+        else :requests
+        end
+
+        rows.sort_by { |row| [ -row[key].to_f, -row[:requests].to_i ] }
+      end
+
+      def traces_scope
+        ActionAgent.trace_model.for_account(current_account)
+      end
+
+      # Same definitions as the gem dashboard's calculate_metrics, with
+      # previous-period percentage changes layered on top.
+      def summary_for(current, previous)
+        total = current.count
+        previous_total = previous.count
+
+        input_tokens = current.sum(:total_input_tokens)
+        output_tokens = current.sum(:total_output_tokens)
+        thinking_tokens = current.sum(:total_thinking_tokens)
+
+        avg_latency = current.average(:total_duration_ms)&.round(0)
+        previous_avg_latency = previous.average(:total_duration_ms)&.round(0)
+
+        error_rate = total.positive? ? (current.with_errors.count.to_f / total * 100).round(2) : 0.0
+
+        {
+          total_requests: total,
+          requests_change: percent_change(previous_total, total),
+          avg_latency_ms: avg_latency || 0,
+          latency_change: percent_change(previous_avg_latency, avg_latency),
+          error_rate: error_rate,
+          errors: current.with_errors.count,
+          unique_agents: current.distinct.count(:agent_class),
+          tokens_used: input_tokens + output_tokens + thinking_tokens,
+          tokens_input: input_tokens,
+          tokens_output: output_tokens,
+          tokens_thinking: thinking_tokens
+        }
+      end
+
+      def hourly_requests(scope, hours, now)
+        traces = ActionAgent.trace_model
+        bucket_sql = Arel.sql(traces.hour_bucket_sql)
+        to_epoch = ->(hash) { hash.transform_keys { |key| traces.hour_bucket_epoch(key) } }
+
+        counts = to_epoch.call(scope.group(bucket_sql).count)
+        latencies = to_epoch.call(scope.group(bucket_sql).average(:total_duration_ms))
+
+        start_hour = (now - (hours - 1).hours).beginning_of_hour
+        (0...hours).map do |offset|
+          bucket = start_hour + offset.hours
+          {
+            hour: bucket.strftime("%H:00"),
+            timestamp: bucket.iso8601,
+            count: counts[bucket.to_i] || 0,
+            avg_latency_ms: latencies[bucket.to_i]&.round(0) || 0,
+            active: offset == hours - 1
+          }
+        end
+      end
+
+      # Mirrors the gem dashboard's agent_statistics grouped query.
+      def agent_statistics(scope)
+        scope
+          .where.not(agent_class: nil)
+          .group(:agent_class)
+          .select(
+            "agent_class",
+            "COUNT(*) AS trace_count",
+            "SUM(total_input_tokens + total_output_tokens + total_thinking_tokens) AS token_sum",
+            "AVG(total_duration_ms) AS avg_duration",
+            "SUM(CASE WHEN status = 'ERROR' THEN 1 ELSE 0 END) AS error_count"
+          )
+          .order(Arel.sql("trace_count DESC"))
+          .map do |row|
+            {
+              name: row.agent_class,
+              requests: row.trace_count,
+              tokens: row.token_sum.to_i,
+              avg_duration_ms: row.avg_duration&.round(0) || 0,
+              errors: row.error_count.to_i
+            }
+          end
+      end
+
+      # Estimated spend for the window, total and per agent class. The model
+      # lives inside the spans JSON (first llm span).
+      def cost_statistics(scope)
+        rows = ActionAgent.trace_model.pluck_with_llm_model(
+          scope, :agent_class, :total_input_tokens, :total_output_tokens
+        )
+
+        by_agent = Hash.new(0.0)
+        total = 0.0
+
+        rows.each do |model, agent_class, input_tokens, output_tokens|
+          cost = ModelPricing.estimate(model: model, input_tokens: input_tokens, output_tokens: output_tokens)
+          next unless cost
+
+          total += cost
+          by_agent[agent_class] += cost if agent_class
+        end
+
+        { total: total.round(4), by_agent: by_agent.transform_values { |v| v.round(4) } }
+      end
+
+      def percent_change(previous, current)
+        return nil if previous.nil? || current.nil? || previous.to_f.zero?
+
+        (((current.to_f - previous.to_f) / previous.to_f) * 100).round(1)
+      end
+    end
+  end
+end

data/app/controllers/action_agent/api/provider_keys_controller.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  module Api
+    # Per-account LLM provider credentials (Settings -> Provider API Keys).
+    # API keys are write-only: responses carry a masked hint, never the key.
+    # Ollama's credential is a host URL and is echoed back in full.
+    class ProviderKeysController < BaseController
+      before_action :require_owner!
+
+      # GET /api/provider_keys — one row per supported provider, configured or not.
+      def index
+        configured = owned(ProviderKey).index_by(&:provider)
+
+        render json: {
+          provider_keys: ProviderKey::PROVIDERS.map do |provider|
+            serialize(provider, configured[provider])
+          end
+        }
+      end
+
+      # POST /api/provider_keys — upserts the credential for a provider.
+      def create
+        provider = params.require(:provider)
+        credential = params.require(:credential)
+
+        record = owned(ProviderKey).find_or_initialize_by(provider: provider)
+        record.update!(credential: credential)
+
+        render json: { provider_key: serialize(provider, record) }, status: :created
+      end
+
+      # DELETE /api/provider_keys/:provider
+      def destroy
+        owned(ProviderKey).find_by!(provider: params[:provider]).destroy!
+        head :no_content
+      end
+
+      private
+
+      def serialize(provider, record)
+        {
+          provider: provider,
+          host_based: ProviderKey::HOST_PROVIDERS.include?(provider),
+          configured: record.present?,
+          hint: record&.display_hint,
+          updated_at: record&.updated_at&.iso8601
+        }
+      end
+    end
+  end
+end