actionagent 1.2.2 → 1.3.0

data/app/controllers/action_agent/api/agent_runs_controller.rb

@@ -63,13 +63,7 @@ module ActionAgent
       def interaction_messages(run)
         return [] if run.trace_id.blank?
 
-        context = AgentContext.for_agents(Agent.where(id: run.agent_id)).order(created_at: :desc).first
-        return [] unless context
-
-        messages = context.messages.chronological.to_a
-        start_index = messages.index do |message|
-          message.role == "user" && message.provenance&.dig("trace_id") == run.trace_id
-        end
+        messages, start_index = run_slice_start(run)
         return [] unless start_index
 
         slice = [ messages[start_index] ]
@@ -93,6 +87,30 @@ module ActionAgent
         serialized
       end
 
+      # solid_agent keys the persisted context by action_name, so each action
+      # has its own stream. The run's own action is searched first; a run
+      # whose action is blank or legacy (or whose trace landed in another
+      # stream) falls back to every context of the agent, newest first.
+      # Picking only the newest context regardless of action left the
+      # conversation empty for every run of any other action.
+      def run_slice_start(run)
+        contexts = AgentContext.for_agents(Agent.where(id: run.agent_id)).order(created_at: :desc)
+        action = run.action_name.presence || run.output_metadata&.dig("action").presence || Agent::DEFAULT_ACTION
+
+        candidates = contexts.for_action(action).to_a
+        candidates += contexts.to_a.reject { |context| candidates.include?(context) }
+
+        candidates.each do |context|
+          messages = context.messages.chronological.to_a
+          start_index = messages.index do |message|
+            message.role == "user" && message.provenance&.dig("trace_id") == run.trace_id
+          end
+          return [ messages, start_index ] if start_index
+        end
+
+        [ [], nil ]
+      end
+
       def run_json(run, include_agent: false)
         json = {
           id: run.id,

data/app/controllers/action_agent/api/agents_controller.rb

@@ -3,6 +3,8 @@
 module ActionAgent
   module Api
     class AgentsController < BaseController
+      include AgentSerialization
+
       # Ranking for the agent cards. Every dimension except "recent" reads the
       # scorecard, which is computed in Ruby over both execution sources, so
       # the ordering is applied there rather than in the SQL scope.
@@ -18,6 +20,7 @@ module ActionAgent
       before_action :set_agent, only: [ :show, :update, :destroy, :versions, :runs, :execute, :test, :restore, :duplicate, :export, :analytics ]
       before_action :require_execution_enabled!, only: [ :execute, :test ]
       before_action :require_owner!, only: [ :execute, :test ]
+      before_action :require_executable_agent!, only: [ :execute, :test ]
       before_action :enforce_execution_quota!, only: [ :execute, :test ]
 
       # GET /api/agents
@@ -199,37 +202,82 @@ module ActionAgent
       end
 
       # GET /api/agents/:id/analytics
+      #
+      # Every execution of this agent, whoever ran it — the same merged model
+      # the runs list and the scorecard use. Agents observed from telemetry
+      # have no AgentRun rows at all, so a runs-only aggregate showed them
+      # with all-zero metrics beside a card and a runs list reporting real
+      # traffic.
       def analytics
         days = (params[:days] || 30).to_i
         start_date = days.days.ago.beginning_of_day
 
         runs = @agent.agent_runs.where("created_at >= ?", start_date)
+        traces = AgentExecutions.unclaimed_traces([ @agent.id ], since: start_date, owner: current_owner)
+        traces_table = ActionAgent.trace_model.table_name
+        trace_tokens_sql = Arel.sql(
+          "COALESCE(#{traces_table}.total_input_tokens, 0) + COALESCE(#{traces_table}.total_output_tokens, 0) + " \
+          "COALESCE(#{traces_table}.total_thinking_tokens, 0)"
+        )
 
-        # Calculate stats
-        total_runs = runs.count
+        # Dashboard runs
+        run_count = runs.count
         completed_runs = runs.where(status: :complete).count
         failed_runs = runs.where(status: :failed).count
-        avg_duration = runs.where.not(duration_ms: nil).average(:duration_ms)&.round || 0
-        total_tokens = runs.sum(:total_tokens)
+        timed_runs = runs.where.not(duration_ms: nil)
+        run_tokens = runs.sum(:total_tokens)
+
+        # Reported executions
+        trace_count = traces.count
+        trace_failures = traces.where(status: "ERROR").count
+        timed_traces = traces.where.not(total_duration_ms: nil)
+        trace_tokens = traces.sum(trace_tokens_sql)
+
+        total_runs = run_count + trace_count
+        completed_runs += trace_count - trace_failures
+        failed_runs += trace_failures
+        total_tokens = run_tokens + trace_tokens
         avg_tokens = total_runs > 0 ? (total_tokens.to_f / total_runs).round : 0
 
-        # Runs by day
-        runs_by_day = runs.group("DATE(created_at)")
+        # Weighted across both sources, so one side's long tail counts for
+        # what it is.
+        timed_total = timed_runs.count + timed_traces.count
+        avg_duration = if timed_total.positive?
+          (timed_runs.sum(:duration_ms) + timed_traces.sum(:total_duration_ms)).to_f / timed_total
+        else
+          0
+        end.round
+
+        # Runs by day, zero-filled across the window (see AnalyticsController)
+        by_day = Hash.new { |hash, date| hash[date] = { date: date, count: 0, tokens: 0 } }
+        runs.group("DATE(created_at)")
           .select("DATE(created_at) as date, COUNT(*) as count, SUM(total_tokens) as tokens")
-          .order("date")
-          .map { |r| { date: r.date.to_s, count: r.count, tokens: r.tokens || 0 } }
+          .each { |r| by_day[r.date.to_s].merge!(count: r.count, tokens: r.tokens || 0) }
+        trace_day_sql = Arel.sql("DATE(#{traces_table}.timestamp)")
+        trace_counts = traces.group(trace_day_sql).count
+        trace_token_sums = traces.group(trace_day_sql).sum(trace_tokens_sql)
+        trace_counts.each do |date, count|
+          bucket = by_day[date.to_s]
+          bucket[:count] += count
+          bucket[:tokens] += trace_token_sums[date].to_i
+        end
+        runs_by_day = (start_date.to_date..Date.current).map { |day| by_day[day.to_s] }
 
-        # Status breakdown
+        # Status breakdown. A reported execution is complete unless its trace
+        # errored; those are the only two states a trace can be in.
         status_breakdown = runs.group(:status).count.transform_keys(&:to_s)
+        status_breakdown["complete"] = status_breakdown.fetch("complete", 0) + (trace_count - trace_failures)
+        status_breakdown["failed"] = status_breakdown.fetch("failed", 0) + trace_failures
+        status_breakdown.delete_if { |_status, count| count.zero? }
 
-        # Recent errors
+        # Recent errors, from both sources
         recent_errors = runs.failed_runs.recent.limit(5).map do |run|
-          {
-            id: run.id,
-            error: run.error_message&.truncate(200),
-            created_at: run.created_at
-          }
+          { id: run.id, source: "dashboard", error: run.error_message&.truncate(200), created_at: run.created_at }
+        end
+        recent_errors += traces.where(status: "ERROR").order(timestamp: :desc).limit(5).map do |trace|
+          { id: "trace-#{trace.id}", source: "reported", error: trace.error_message&.truncate(200), created_at: trace.timestamp }
         end
+        recent_errors = recent_errors.sort_by { |row| row[:created_at] }.reverse.first(5)
 
         render json: {
           period_days: days,
@@ -265,6 +313,19 @@ module ActionAgent
 
       private
 
+      # Observed agents were discovered from reported telemetry; the platform
+      # has no configuration to run them with (a placeholder model, no
+      # instructions), so executing one only manufactured a failed run that
+      # was then blended into the clean scorecard its telemetry had built.
+      # Duplicating an observed agent yields a draft that can be run.
+      def require_executable_agent!
+        return unless @agent.observed?
+
+        render json: {
+          error: "Observed agents are read-only — duplicate this agent to create an executable copy"
+        }, status: :unprocessable_entity
+      end
+
       def list_sort(requested)
         LIST_SORTS.key?(requested.to_s) ? requested.to_s : DEFAULT_LIST_SORT
       end
@@ -323,39 +384,6 @@ module ActionAgent
         )
       end
 
-      def agent_json(agent, include_details: false)
-        json = {
-          id: agent.id,
-          name: agent.name,
-          slug: agent.slug,
-          description: agent.description,
-          provider: agent.provider,
-          model: agent.model,
-          status: agent.status,
-          preset_type: agent.preset_type,
-          appearance: agent.appearance,
-          version_count: agent.version_count,
-          created_at: agent.created_at,
-          updated_at: agent.updated_at
-        }
-
-        if include_details
-          json.merge!(
-            instructions: agent.instructions,
-            action_prompts: agent.action_prompts,
-            instruction_sets: agent.instruction_sets,
-            tools: agent.tools,
-            mcp_servers: agent.mcp_servers,
-            model_config: agent.model_config,
-            response_format: agent.response_format,
-            agent_class_name: agent.agent_class_name,
-            telemetry_agent_class: agent.telemetry_agent_class
-          )
-        end
-
-        json
-      end
-
       def version_json(version, include_diff: false)
         json = {
           id: version.id,

data/app/controllers/action_agent/api/analytics_controller.rb

@@ -32,17 +32,26 @@ module ActionAgent
         avg_duration = runs.where.not(duration_ms: nil).average(:duration_ms)&.round || 0
         avg_tokens_per_run = total_runs > 0 ? (total_tokens.to_f / total_runs).round : 0
 
-        # Runs over time
-        runs_by_day = runs.group("DATE(#{runs_table}.created_at)")
-          .select("DATE(#{runs_table}.created_at) as date, COUNT(*) as count")
-          .order("date")
-          .map { |r| { date: r.date.to_s, count: r.count } }
+        # Runs over time. Zero-filled across the window: grouping only
+        # returns days that have rows, and the chart draws whatever it gets
+        # as adjacent bars, so a 30-day window with runs on two far-apart
+        # days rendered as two neighbouring bars.
+        runs_by_day = zero_filled_days(
+          start_date,
+          runs.group("DATE(#{runs_table}.created_at)")
+            .select("DATE(#{runs_table}.created_at) as date, COUNT(*) as count")
+            .map { |r| { date: r.date.to_s, count: r.count } },
+          count: 0
+        )
 
         # Token usage over time
-        tokens_by_day = runs.group("DATE(#{runs_table}.created_at)")
-          .select("DATE(#{runs_table}.created_at) as date, SUM(total_tokens) as tokens")
-          .order("date")
-          .map { |r| { date: r.date.to_s, tokens: r.tokens || 0 } }
+        tokens_by_day = zero_filled_days(
+          start_date,
+          runs.group("DATE(#{runs_table}.created_at)")
+            .select("DATE(#{runs_table}.created_at) as date, SUM(total_tokens) as tokens")
+            .map { |r| { date: r.date.to_s, tokens: r.tokens || 0 } },
+          tokens: 0
+        )
 
         # Top agents by usage
         top_agents = agents.joins(:agent_runs)
@@ -89,6 +98,19 @@ module ActionAgent
           provider_breakdown: provider_breakdown
         }
       end
+
+      private
+
+      # One entry per calendar day from +start_date+ through today, in
+      # order, with +defaults+ for the days the grouped +rows+ did not
+      # mention. Keyed on the ISO date string so it reads the same whether
+      # the adapter returns DATE() as a Date or a String.
+      def zero_filled_days(start_date, rows, **defaults)
+        by_date = rows.index_by { |row| row[:date] }
+        (start_date.to_date..Date.current).map do |day|
+          by_date[day.to_s] || defaults.merge(date: day.to_s)
+        end
+      end
     end
   end
 end

data/app/controllers/action_agent/api/base_controller.rb

@@ -20,9 +20,25 @@ module ActionAgent
       rescue_from ActiveRecord::RecordNotFound, with: :not_found
       rescue_from ActiveRecord::RecordInvalid, with: :unprocessable_entity
       rescue_from ActionController::ParameterMissing, with: :bad_request
+      rescue_from ActiveRecord::Encryption::Errors::Configuration, with: :encryption_unconfigured
 
       private
 
+      # API keys and provider credentials are encrypted at rest, which needs
+      # Active Record Encryption keys. The engine derives fallback keys when
+      # the host set none (see Engine's action_agent.active_record_encryption
+      # initializer), so this is only reached when that fallback was disabled
+      # or the host's own keys are broken — in which case the operator gets
+      # told what to do rather than an HTML 500 the Settings view collapses
+      # into "Could not create the API key."
+      def encryption_unconfigured(exception)
+        render json: {
+          error: "Active Record encryption is not configured (#{exception.message}). " \
+                 "Run `rails db:encryption:init` and add the keys to your credentials, " \
+                 "or set ActionAgent.encrypt_credentials = false to store credentials unencrypted."
+        }, status: :service_unavailable
+      end
+
       # Scopes +relation+ to the caller, following the model's own
       # declaration. Unowned models (a single-user install, or a model that
       # nothing owns) come back unfiltered.

data/app/controllers/action_agent/api/evaluations_controller.rb

@@ -4,8 +4,20 @@ module ActionAgent
   module Api
     # CRUD + execution for agent evaluations, backing the dashboard
     # Evaluations view. Scoped to the current user's agents.
+    #
+    # An evaluation created with scenarios (a pasted list of user messages)
+    # is a scenario suite: runs replay the scenarios through the agent rather
+    # than sampling recorded generations, and can be narrowed to a group, to
+    # specific scenarios, or to specific models.
     class EvaluationsController < BaseController
       before_action :require_owner!
+      # A scenario suite replays its prompts through the provider, so creating
+      # one that runs, or running one, executes the agent and is gated the way
+      # AgentsController#execute is: the dashboard's execution switch, no
+      # observed (read-only) agents, and the owner's execution quota. Each
+      # replay then counts as one execution (ScenarioEvaluationRunner#replay).
+      before_action :require_execution_enabled!, :require_executable_scenario_agent!, :enforce_execution_quota!,
+                    only: [ :create, :run ], if: :replays_scenarios?
 
       # Default criteria used when none are supplied — all rule-based, so a
       # new evaluation produces real scores without provider credentials.
@@ -25,7 +37,7 @@ module ActionAgent
       def index
         scope = evaluations_scope
         scope = scope.where(agent_id: params[:agent_id]) if params[:agent_id].present?
-        evaluations = scope.includes(:agent, :evaluation_runs).recent.limit(50)
+        evaluations = scope.includes(:agent, :evaluation_runs, :scenarios).recent.limit(50)
 
         render json: { evaluations: evaluations.map { |evaluation| serialize(evaluation) } }
       end
@@ -36,6 +48,7 @@ module ActionAgent
 
         render json: {
           evaluation: serialize(evaluation).merge(
+            scenarios: evaluation.scenarios.ordered.map(&:as_json_summary),
             runs: evaluation.evaluation_runs.recent.limit(20).map { |run| serialize_run(run) }
           )
         }
@@ -43,11 +56,12 @@ module ActionAgent
 
       # POST /api/evaluations
       def create
-        agent = owner_agents.find(params.require(:evaluation)[:agent_id])
+        agent = requested_agent
 
         judge_kind = evaluation_params[:judge_kind].presence || "rules"
         config = {}
         config["compare_models"] = compare_models_param if compare_models_param.any?
+        scenarios = scenario_attributes
 
         evaluation = agent.evaluations.new(
           name: evaluation_params[:name],
@@ -59,9 +73,15 @@ module ActionAgent
           criteria: judge_kind == "judge_defined" ? explicit_criteria : normalized_criteria,
           config: config
         )
+        scenarios.each_with_index do |attrs, index|
+          evaluation.scenarios.build(
+            key: attrs["key"], prompt: attrs["prompt"], group: attrs["group"], notes: attrs["notes"],
+            expectations: attrs["expectations"] || {}, position: attrs.fetch("position", index)
+          )
+        end
 
         if evaluation.save
-          evaluation.run!
+          start_run(evaluation, selection_params) if run_requested?
           render json: { evaluation: serialize(evaluation.reload) }, status: :created
         else
           render json: { errors: evaluation.errors.full_messages }, status: :unprocessable_entity
@@ -69,13 +89,94 @@ module ActionAgent
       end
 
       # POST /api/evaluations/:id/run
+      # A scenario suite accepts a selection: scenario_ids[], keys[], group,
+      # models[] (or a comma-separated `models` string).
       def run
-        evaluation = evaluations_scope.find(params[:id])
-        run = evaluation.run!
+        evaluation = current_evaluation
+        run = start_run(evaluation, selection_params)
 
         render json: { evaluation: serialize(evaluation.reload), run: serialize_run(run) }
       end
 
+      # GET /api/evaluations/:id/runs/:run_id
+      # One run in full: its per-scenario, per-model results alongside the
+      # scenarios, so the matrix and every answer can be rendered, and its
+      # fix items — the faults grouped with the tools, MCP server and
+      # dashboard action that address each. Fix item paths are relative to
+      # the mount: the React app resolves them itself (dashboardPath).
+      def show_run
+        evaluation = evaluations_scope.find(params[:id])
+        run = evaluation.evaluation_runs.find(params[:run_id])
+        results = run.scenario_results.includes(:scenario).joins(:scenario)
+          .order(EvaluationScenario.arel_table[:position], EvaluationScenario.arel_table[:id], :model)
+
+        render json: {
+          evaluation: serialize(evaluation),
+          run: serialize_run(run).merge(results: results.map(&:as_json_summary), fix_items: safe_fix_items(run))
+        }
+      end
+
+      # GET /api/evaluations/:id/scenarios
+      def scenarios
+        evaluation = evaluations_scope.find(params[:id])
+
+        render json: {
+          scenarios: evaluation.scenarios.ordered.map(&:as_json_summary),
+          groups: evaluation.scenario_groups
+        }
+      end
+
+      # PUT /api/evaluations/:id/scenarios
+      # Replaces the suite from pasted text (`scenarios_text`) or a list
+      # (`scenarios`). Scenarios whose key survives keep their results.
+      def replace_scenarios
+        evaluation = evaluations_scope.find(params[:id])
+        attributes = scenario_attributes
+        return render json: { errors: [ "No scenarios found in the pasted text" ] }, status: :unprocessable_entity if attributes.empty?
+
+        evaluation.replace_scenarios!(attributes)
+
+        render json: {
+          evaluation: serialize(evaluation.reload),
+          scenarios: evaluation.scenarios.ordered.map(&:as_json_summary),
+          groups: evaluation.scenario_groups
+        }
+      end
+
+      # PATCH /api/evaluations/:id/scenarios/:scenario_id
+      def update_scenario
+        evaluation = evaluations_scope.find(params[:id])
+        scenario = evaluation.scenarios.find(params[:scenario_id])
+        scenario.update!(scenario_params)
+
+        render json: { scenario: scenario.as_json_summary }
+      end
+
+      # DELETE /api/evaluations/:id/scenarios/:scenario_id
+      def destroy_scenario
+        evaluation = evaluations_scope.find(params[:id])
+        evaluation.scenarios.find(params[:scenario_id]).destroy!
+        head :no_content
+      end
+
+      # GET /api/evaluations/:id/runs/:run_id/report?theme=dark
+      #
+      # The run as the framework's self-contained HTML report page — the
+      # in-dashboard view and, because the page is a single file, the export.
+      # `theme` (light|dark) pins the palette to the dashboard's; without it
+      # the page follows the viewer's own preference. The page is served
+      # outside the React app, so its fix item actions link at the absolute
+      # mount path (request.script_name) rather than relative to it.
+      def run_report
+        evaluation = evaluations_scope.find(params[:id])
+        run = evaluation.evaluation_runs.find(params[:run_id])
+        raise ActiveRecord::RecordNotFound unless evaluation.scenario_suite?
+
+        report = run.to_report(links: run.report_links(mount: request.script_name))
+
+        render html: report.to_html(theme: params[:theme]).html_safe, layout: false
+      end
+
       # DELETE /api/evaluations/:id
       def destroy
         evaluations_scope.find(params[:id]).destroy!
@@ -84,14 +185,111 @@ module ActionAgent
 
       private
 
+      # A scenario suite replays through the provider once per scenario and
+      # model, so it runs in the background; a generation-sampling evaluation
+      # scores recorded data and finishes inline.
+      def start_run(evaluation, selection)
+        return evaluation.run_later!(**selection) if evaluation.scenario_suite?
+
+        # EvaluationRunnerService marks the run failed with the error message
+        # and then re-raises. Letting that escape returned an HTML 500 for a
+        # request that had already persisted the evaluation and its failed
+        # run: the client saw a JSON parse error, the form stayed open, and a
+        # resubmit failed on the now-taken name. The failure is on the run
+        # record, which is what the response carries.
+        evaluation.run!
+      rescue StandardError => e
+        Rails.logger.warn(
+          "[ActionAgent] evaluation #{evaluation.id} run failed: #{e.class}: #{e.message}"
+        )
+        # The service records the failure before re-raising; a failure that
+        # predates the run record (creating it, say) is recorded here so the
+        # response always carries one.
+        evaluation.evaluation_runs.recent.first ||
+          evaluation.evaluation_runs.create!(status: :failed, error_message: e.message, completed_at: Time.current)
+      end
+
       def evaluations_scope
         Evaluation.joins(:agent).where(agent: owner_agents)
       end
 
+      def current_evaluation
+        @current_evaluation ||= evaluations_scope.find(params[:id])
+      end
+
+      def requested_agent
+        @requested_agent ||= owner_agents.find(params.require(:evaluation)[:agent_id])
+      end
+
+      # create runs the new evaluation unless told not to.
+      def run_requested?
+        run = params.require(:evaluation)[:run]
+        run != false && run != "false"
+      end
+
+      # Whether this request replays scenarios through the agent: running a
+      # scenario suite, or creating an evaluation with scenarios that runs.
+      def replays_scenarios?
+        case action_name
+        when "run" then current_evaluation.scenario_suite?
+        when "create" then run_requested? && scenario_attributes.any?
+        else false
+        end
+      end
+
+      # The refusal AgentsController gives an observed agent: it was
+      # discovered from telemetry and has nothing to execute.
+      def require_executable_scenario_agent!
+        agent = action_name == "create" ? requested_agent : current_evaluation.agent
+        return unless agent.observed?
+
+        render json: {
+          error: "Observed agents are read-only — duplicate this agent to create an executable copy"
+        }, status: :unprocessable_entity
+      end
+
       def evaluation_params
         params.require(:evaluation).permit(:agent_id, :name, :judge_kind, :judge_model, :sample_size)
       end
 
+      def scenario_params
+        params.require(:scenario).permit(:prompt, :group, :notes, :enabled, :key, expectations: {})
+      end
+
+      # scenario_ids, keys, group and models narrow a scenario run. `models`
+      # may arrive as an array or as the comma-separated field the form posts.
+      def selection_params
+        source = params[:evaluation].is_a?(ActionController::Parameters) && params[:evaluation].key?(:selection) ? params[:evaluation][:selection] : params
+        models = source[:models]
+        models = models.to_s.split(",") unless models.is_a?(Array)
+
+        {
+          scenario_ids: Array(source[:scenario_ids]).map(&:to_s).reject(&:blank?),
+          keys: Array(source[:keys]).map(&:to_s).reject(&:blank?),
+          group: source[:group].to_s.presence,
+          models: models.map(&:to_s).map(&:strip).reject(&:blank?)
+        }.compact_blank
+      end
+
+      # Scenarios from the request: a pasted text block, a list of objects, or
+      # nothing (a generation-sampling evaluation).
+      def scenario_attributes
+        @scenario_attributes ||= begin
+          source = params[:evaluation].presence || params
+          text = source[:scenarios_text].to_s
+          list = source[:scenarios]
+
+          if list.present?
+            list = list.to_unsafe_h.values if list.is_a?(ActionController::Parameters)
+            ActiveAgent::Evals::ScenarioParser.parse(Array(list).map { |entry| entry.respond_to?(:to_unsafe_h) ? entry.to_unsafe_h : entry }.to_json)
+          elsif text.present?
+            ActiveAgent::Evals::ScenarioParser.parse(text)
+          else
+            []
+          end
+        end
+      end
+
       def normalized_criteria
         explicit_criteria.presence || DEFAULT_CRITERIA.deep_dup
       end
@@ -109,7 +307,9 @@ module ActionAgent
       end
 
       def compare_models_param
-        Array(params[:evaluation][:compare_models]).map(&:to_s).reject(&:blank?)
+        models = params[:evaluation][:compare_models]
+        models = models.to_s.split(",") unless models.is_a?(Array)
+        models.map(&:to_s).map(&:strip).reject(&:blank?)
       end
 
       def serialize(evaluation)
@@ -125,6 +325,9 @@ module ActionAgent
           compare_models: evaluation.compare_models,
           config: evaluation.config,
           sample_size: evaluation.sample_size,
+          scenario_suite: evaluation.scenario_suite?,
+          scenario_count: evaluation.scenarios.size,
+          scenario_groups: evaluation.scenario_suite? ? evaluation.scenario_groups : [],
           created_at: evaluation.created_at.iso8601,
           latest_run: latest ? serialize_run(latest) : nil
         }
@@ -135,14 +338,41 @@ module ActionAgent
           id: run.id,
           status: run.status,
           scores: run.scores,
-          average_score: run.average_score,
+          selection: run.selection,
+          models: run.models,
+          average_score: safe_average_score(run),
           samples_evaluated: run.samples_evaluated,
           samples_passed: run.samples_passed,
+          usage: run.usage,
           error_message: run.error_message,
           completed_at: run.completed_at&.iso8601,
           created_at: run.created_at.iso8601
         }
       end
+
+      # The fix items are derived from every persisted result's diagnosis,
+      # which older runs recorded in earlier shapes; a run they cannot be
+      # built for still serves its results rather than 500-ing the panel.
+      def safe_fix_items(run)
+        run.fix_items
+      rescue StandardError => e
+        Rails.logger.warn(
+          "[ActionAgent] evaluation run #{run.id} fix_items failed: #{e.class}: #{e.message}"
+        )
+        []
+      end
+
+      # index serializes the latest run of every listed evaluation, so an
+      # unaverageable scores payload used to 500 the entire Evaluations page
+      # instead of degrading that one run's headline number.
+      def safe_average_score(run)
+        run.average_score
+      rescue StandardError => e
+        Rails.logger.warn(
+          "[ActionAgent] evaluation run #{run.id} average_score failed: #{e.class}: #{e.message}"
+        )
+        nil
+      end
     end
   end
 end

data/app/controllers/action_agent/api/mcp_controller.rb

@@ -19,10 +19,10 @@ module ActionAgent
     # Connect from an MCP client with:
     #   { "type": "http", "url": "https://activeagents.ai/mcp",
     #     "headers": { "Authorization": "Bearer aa_..." } }
-    class McpController < BaseController
+    class MCPController < BaseController
       # Authenticated by API key rather than by the host app's sessions.
       allow_unauthenticated_access
-      before_action :authenticate_api_key!
+      before_action :authenticate_api_key!, except: [ :unsupported ]
 
       PROTOCOL_VERSION = "2025-03-26"
       JSONRPC_METHOD_NOT_FOUND = -32601
@@ -51,10 +51,20 @@ module ActionAgent
       rescue McpError => e
         render_error(request_id, e.code, e.message)
       rescue StandardError => e
-        Rails.logger.error("[Api::McpController] #{e.class}: #{e.message}")
+        Rails.logger.error("[Api::MCPController] #{e.class}: #{e.message}")
         render_error(request_id, JSONRPC_SERVER_ERROR, "Internal error")
       end
 
+      # GET (open an SSE stream) and DELETE (end a session) on the endpoint.
+      # Neither is offered: per Streamable HTTP a server that does not
+      # provide a stream MUST answer GET with 405, and an unsupported
+      # session DELETE likewise. Unauthenticated on purpose — a client
+      # probing for the stream should learn "not offered", not "sign in".
+      def unsupported
+        response.headers["Allow"] = "POST"
+        head :method_not_allowed
+      end
+
       private
 
       # JSON-RPC errors ride on HTTP 200 per the MCP Streamable HTTP transport.