actionagent 0.0.0 → 1.2.0

data/app/controllers/action_agent/api/provider_models_controller.rb

@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  module Api
+    # Model catalogs for the agent builder/editor dropdowns.
+    #
+    # Hosted providers get a curated list of current models (kept here, server
+    # side, so the UI can't drift stale). Ollama is queried live from the
+    # account's configured host (Settings -> Provider API Keys, falling back to
+    # the platform config) so locally pulled models appear; OpenRouter is
+    # queried from its public catalog. Live lookups fall back to the curated
+    # list on any failure.
+    class ProviderModelsController < BaseController
+      before_action :require_owner!
+
+      FETCH_TIMEOUT_SECONDS = 4
+
+      # Fallbacks when a live lookup isn't possible (reviewed 2026-07). First
+      # entry is the default the builder preselects.
+      CURATED = {
+        "openai" => %w[gpt-5.1 gpt-5 gpt-5-mini gpt-5-nano],
+        "anthropic" => %w[claude-opus-5 claude-fable-5 claude-sonnet-5 claude-opus-4-8 claude-haiku-4-5],
+        "openrouter" => %w[anthropic/claude-sonnet-4.5 openai/gpt-5.1 meta-llama/llama-3.3-70b-instruct qwen/qwen3-32b],
+        "ollama" => %w[qwen3:8b llama3.2 mistral gemma3]
+      }.freeze
+
+      # GET /api/provider_models?provider=ollama
+      def index
+        provider = params[:provider].to_s
+        unless Agent::PROVIDERS.include?(provider)
+          return render json: { error: "Unknown provider: #{provider}" }, status: :unprocessable_entity
+        end
+
+        models, source = case provider
+        when "ollama" then live_ollama_models
+        when "openrouter" then live_openrouter_models
+        when "anthropic" then live_anthropic_models
+        end
+
+        if models.blank?
+          models = CURATED.fetch(provider)
+          source = "curated"
+        end
+
+        render json: { provider: provider, models: models, source: source }
+      end
+
+      private
+
+      # The owner's configured Ollama endpoint, else the host app's default
+      # from config/active_agent.yml.
+      def ollama_host
+        key = owner_provider_key("ollama")
+        host = key&.credential.presence || ActiveAgent.configuration[:ollama]&.dig(:host)
+        host.presence
+      end
+
+      def owner_provider_key(provider)
+        owned(ProviderKey).find_by(provider: provider)
+      end
+
+      def live_ollama_models
+        host = ollama_host
+        return nil unless host
+
+        data = fetch_json(URI.join("#{host.chomp('/')}/", "models"))
+        ids = Array(data&.dig("data")).filter_map { |model| model["id"] }
+        [ ids.sort, "live" ] if ids.any?
+      rescue StandardError => e
+        Rails.logger.warn("[ProviderModels] ollama lookup failed: #{e.message}")
+        nil
+      end
+
+      # Queries the Anthropic Models API with the account's key (newest first,
+      # as returned by the API) so new model releases appear without a deploy.
+      def live_anthropic_models
+        key = current_user_provider_key("anthropic")&.credential
+        return nil if key.blank?
+
+        data = Rails.cache.fetch("provider_models:anthropic:#{Digest::SHA256.hexdigest(key)}", expires_in: 1.hour) do
+          uri = URI.parse("https://api.anthropic.com/v1/models?limit=50")
+          response = Net::HTTP.start(
+            uri.host, uri.port,
+            use_ssl: true, open_timeout: FETCH_TIMEOUT_SECONDS, read_timeout: FETCH_TIMEOUT_SECONDS
+          ) { |http| http.get(uri.request_uri, { "x-api-key" => key, "anthropic-version" => "2023-06-01" }) }
+          response.code.to_i == 200 ? JSON.parse(response.body) : nil
+        end
+        ids = Array(data&.dig("data")).filter_map { |model| model["id"] }
+        [ ids, "live" ] if ids.any?
+      rescue StandardError => e
+        Rails.logger.warn("[ProviderModels] anthropic lookup failed: #{e.message}")
+        nil
+      end
+
+      def live_openrouter_models
+        data = Rails.cache.fetch("provider_models:openrouter", expires_in: 1.hour) do
+          fetch_json(URI.parse("https://openrouter.ai/api/v1/models"))
+        end
+        ids = Array(data&.dig("data")).filter_map { |model| model["id"] }
+        [ ids.sort.first(100), "live" ] if ids.any?
+      rescue StandardError => e
+        Rails.logger.warn("[ProviderModels] openrouter lookup failed: #{e.message}")
+        nil
+      end
+
+      def fetch_json(uri)
+        response = Net::HTTP.start(
+          uri.host, uri.port,
+          use_ssl: uri.scheme == "https",
+          open_timeout: FETCH_TIMEOUT_SECONDS,
+          read_timeout: FETCH_TIMEOUT_SECONDS
+        ) { |http| http.get(uri.request_uri) }
+        return nil unless response.code.to_i == 200
+
+        JSON.parse(response.body)
+      end
+    end
+  end
+end

data/app/controllers/action_agent/api/sandboxes_controller.rb

@@ -0,0 +1,224 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  module Api
+    class SandboxesController < BaseController
+      # Authenticated like the rest of the dashboard. This controller used to
+      # opt out entirely for an anonymous free tier, which made #run and
+      # #compare an open proxy: any unauthenticated caller could execute
+      # arbitrary prompts against the host app's provider credentials, and
+      # #show would read back any session by id. Opting out also skipped the
+      # callback that refuses to serve an unauthenticated dashboard outside
+      # development, so it bypassed that safeguard too.
+
+      before_action :require_execution_enabled!, only: [ :run, :compare ]
+      before_action :enforce_execution_quota!, only: [ :compare ]
+      before_action :set_sandbox, only: [ :show, :run, :destroy ]
+
+      # POST /api/sandboxes/compare
+      # Run multiple providers in a single sandbox using parallel generation jobs
+      def compare
+        providers = params[:providers] || %w[anthropic openai ollama]
+        task = params[:task]
+        sandbox_id = params[:sandbox_id]
+
+        return render json: { error: "Task required" }, status: :bad_request unless task.present?
+        return render json: { error: "At least 2 providers required" }, status: :bad_request if providers.size < 2
+
+        # Validate providers
+        invalid = providers - %w[anthropic openai ollama]
+        return render json: { error: "Invalid providers: #{invalid.join(', ')}" }, status: :bad_request if invalid.any?
+
+        # Use existing sandbox or create a new one (single container per user)
+        sandbox = if sandbox_id.present?
+          owned(SandboxSession).find_by!(session_id: sandbox_id)
+        else
+          s = SandboxSession.new(sandbox_type: params[:sandbox_type] || "playwright_mcp")
+          s.user = current_user if s.respond_to?(:user=)
+          s.save!
+          s.provision!
+          s.reload
+          s
+        end
+
+        unless sandbox.can_run?
+          return render json: {
+            error: sandbox.expired? ? "Session expired" : "Maximum runs exceeded",
+            sandbox: sandbox.summary
+          }, status: :unprocessable_entity
+        end
+
+        sandbox.update!(status: :running)
+        comparison_id = SecureRandom.uuid
+
+        # Spawn a separate generation job for each provider (all in same sandbox)
+        runs = providers.map do |provider|
+          run_id = SecureRandom.uuid
+          SandboxRunJob.perform_later(sandbox.id, run_id, task, provider)
+
+          {
+            provider: provider,
+            run_id: run_id,
+            status: "running"
+          }
+        end
+
+        render json: {
+          comparison_id: comparison_id,
+          task: task,
+          sandbox: sandbox.summary,
+          runs: runs
+        }, status: :accepted
+      end
+
+      # GET /api/sandboxes
+      # List available sandbox types and sample tasks
+      def index
+        render json: {
+          sandbox_types: SandboxSession::SANDBOX_TYPES,
+          free_tier_limits: SandboxSession::FREE_TIER_LIMITS,
+          templates: free_tier_templates,
+          sample_tasks: sample_tasks
+        }
+      end
+
+      # POST /api/sandboxes
+      # Create a new sandbox session, owned by whoever opened it.
+      def create
+        @sandbox = SandboxSession.new(sandbox_params)
+        # Guarded: the association only exists when the host app configured a
+        # user model, and a single-user install configures none.
+        @sandbox.user = current_user if @sandbox.respond_to?(:user=)
+        @sandbox.agent_template = AgentTemplate.find_by(slug: params[:template_slug]) if params[:template_slug]
+
+        if @sandbox.save
+          @sandbox.provision!
+          @sandbox.reload # Reload to get updated status after provisioning
+          render json: { sandbox: @sandbox.summary }, status: :created
+        else
+          render json: { errors: @sandbox.errors.full_messages }, status: :unprocessable_entity
+        end
+      end
+
+      # GET /api/sandboxes/:session_id
+      # Get sandbox status and run history
+      def show
+        render json: { sandbox: @sandbox.details }
+      end
+
+      # POST /api/sandboxes/:session_id/run
+      # Execute a task in the sandbox
+      def run
+        unless @sandbox.can_run?
+          return render json: {
+            error: @sandbox.expired? ? "Session expired" : "Maximum runs exceeded",
+            sandbox: @sandbox.summary
+          }, status: :unprocessable_entity
+        end
+
+        # Whatever limits the host app imposes on running an agent.
+        if (denial = ActionAgent.quota_denial(current_owner, :execution))
+          return render json: {
+            error: "Plan limit reached",
+            upgrade_required: true,
+            message: denial
+          }, status: :payment_required
+        end
+
+        task = params[:task]
+        return render json: { error: "Task required" }, status: :bad_request unless task.present?
+
+        # Provider selection (default to anthropic)
+        provider = params[:provider] || "anthropic"
+        unless %w[anthropic openai ollama].include?(provider)
+          return render json: { error: "Invalid provider" }, status: :bad_request
+        end
+
+        record_execution_usage
+
+        @sandbox.update!(status: :running)
+
+        # Execute via job for async processing
+        run_id = SecureRandom.uuid
+        SandboxRunJob.perform_later(@sandbox.id, run_id, task, provider)
+
+        render json: {
+          run_id: run_id,
+          status: "running",
+          provider: provider,
+          sandbox: @sandbox.summary
+        }, status: :accepted
+      end
+
+      # DELETE /api/sandboxes/:session_id
+      # End sandbox session
+      def destroy
+        @sandbox.expire!
+        render json: { deleted: true }
+      end
+
+      private
+
+      def set_sandbox
+        @sandbox = owned(SandboxSession).find_by!(session_id: params[:id])
+      end
+
+      def sandbox_params
+        params.permit(:sandbox_type)
+      end
+
+      def free_tier_templates
+        AgentTemplate.free_tier.featured.map do |template|
+          {
+            slug: template.slug,
+            name: template.name,
+            description: template.description,
+            icon: template.icon,
+            sandbox_type: template.preset_type == "playwright" ? "playwright_mcp" : template.preset_type
+          }
+        end
+      end
+
+      def sample_tasks
+        {
+          playwright_mcp: [
+            {
+              name: "Screenshot Example.com",
+              task: "Take a screenshot of https://example.com",
+              description: "Navigate to example.com and capture a screenshot"
+            },
+            {
+              name: "Extract Hacker News Headlines",
+              task: "Go to https://news.ycombinator.com and list the top 5 story titles with their scores",
+              description: "Scrape the front page of Hacker News"
+            },
+            {
+              name: "Check Wikipedia",
+              task: "Navigate to https://en.wikipedia.org/wiki/Artificial_intelligence and extract the first paragraph",
+              description: "Extract content from Wikipedia"
+            },
+            {
+              name: "GitHub Trending",
+              task: "Visit https://github.com/trending and list the top 3 trending repositories",
+              description: "Check GitHub's trending repositories"
+            }
+          ],
+          terminal: [
+            {
+              name: "System Info",
+              task: "Show the current system information",
+              description: "Display OS, memory, and CPU details"
+            }
+          ],
+          research: [
+            {
+              name: "Topic Summary",
+              task: "Research and summarize the latest developments in AI",
+              description: "Search and compile information on a topic"
+            }
+          ]
+        }
+      end
+    end
+  end
+end