actionagent 1.2.2 → 1.3.0

data/app/jobs/action_agent/sandbox_cleanup_job.rb

@@ -4,16 +4,16 @@ module ActionAgent
   class SandboxCleanupJob < ApplicationJob
     queue_as :sandboxes
 
-    # Clean up Cloud Run resources for an expired sandbox
+    # Release the infrastructure behind an expired sandbox.
     def perform(sandbox_session_id)
       sandbox = SandboxSession.find_by(id: sandbox_session_id)
       return unless sandbox
 
       Rails.logger.info("Cleaning up sandbox: #{sandbox.session_id}")
 
-      # Delete Cloud Run Job if exists
+      # Terminate the backend resource if one was provisioned
       if sandbox.cloud_run_job_id.present? && !Rails.env.development?
-        delete_cloud_run_job(sandbox.cloud_run_job_id)
+        terminate_backend_sandbox(sandbox.cloud_run_job_id)
       end
 
       # Optionally delete old sandbox records
@@ -30,13 +30,16 @@ module ActionAgent
 
     private
 
-    def delete_cloud_run_job(job_id)
-      require "google/cloud/run/v2"
-
-      client = Google::Cloud::Run::V2::Jobs::Client.new
-      client.delete_job(name: job_id)
-    rescue => e
-      Rails.logger.warn("Failed to delete Cloud Run job #{job_id}: #{e.message}")
+    # Through the orchestrator, like provisioning: whichever backend the
+    # host registered (Incus, Kubernetes, Cloud Run, or the built-in mock)
+    # reclaims its own resource. This used to require google/cloud/run/v2
+    # directly, which the engine does not depend on — a LoadError is a
+    # ScriptError, not a StandardError, so it escaped the rescue and the job
+    # failed on every host but the one that happened to bundle the SDK.
+    def terminate_backend_sandbox(sandbox_id)
+      SandboxOrchestrator.new.terminate(sandbox_id)
+    rescue StandardError => e
+      Rails.logger.warn("Failed to terminate sandbox #{sandbox_id}: #{e.message}")
     end
   end
 end

data/app/models/action_agent/agent.rb

@@ -181,14 +181,21 @@ module ActionAgent
       agent_versions.count
     end
 
-    # Generate Ruby agent class code
+    # Generate Ruby agent class code.
+    #
+    # The class is named by telemetry_agent_class: it parameterizes a name
+    # with spaces ("My Agent" -> MyAgentAgent, not `class My AgentAgent`) and
+    # appends the Agent suffix only when it is missing, so an observed agent
+    # whose reported class already ends in Agent is not doubled. It is also
+    # the key traces are correlated on, so the exported class reports under
+    # the same name this record listens for.
     def to_agent_class_code
       <<~RUBY
-        class #{agent_class_name || name.camelize}Agent < ApplicationAgent
+        class #{telemetry_agent_class} < ApplicationAgent
           generate_with :#{provider}, model: "#{model}"#{model_config_code}
 
           def perform
-            prompt#{instructions_code}
+            #{instructions_code}
           end
         end
       RUBY
@@ -334,10 +341,12 @@ module ActionAgent
       ", #{configs}"
     end
 
+    # Exactly one prompt call: a bare `prompt` without instructions, or a
+    # single `prompt instructions:` heredoc with them.
     def instructions_code
-      return "" if instructions.blank?
+      return "prompt" if instructions.blank?
 
-      "\n    prompt instructions: <<~INSTRUCTIONS\n      #{instructions.gsub("\n", "\n      ")}\n    INSTRUCTIONS"
+      "prompt instructions: <<~INSTRUCTIONS\n      #{instructions.gsub("\n", "\n      ")}\n    INSTRUCTIONS"
     end
   end
 end

data/app/models/action_agent/agent_template.rb

@@ -24,10 +24,14 @@ module ActionAgent
       automation
     ].freeze
 
-    # Create an agent from this template for a user
-    def create_agent_for(user, name: nil)
-      agent = user.agents.build(
-        name: name || self.name,
+    # Build (unsaved) an agent from this template inside +relation+: a host
+    # user's agents association, or the engine's owner scope
+    # (Api::BaseController#owner_agents). The relation decides the owner —
+    # including no owner at all in a single-user install, where the old
+    # `user.agents.build` had no user to call it on and raised.
+    def build_agent_in(relation, name: nil)
+      relation.build(
+        name: name.presence || self.name,
         description: description,
         provider: provider,
         model: model,
@@ -40,6 +44,12 @@ module ActionAgent
         model_config: model_config,
         status: :draft
       )
+    end
+
+    # Create an agent from this template for a host user with an `agents`
+    # association.
+    def create_agent_for(user, name: nil)
+      agent = build_agent_in(user.agents, name: name)
 
       if agent.save
         increment!(:usage_count)
@@ -158,12 +168,17 @@ module ActionAgent
           appearance: { hat: "fedora", hatAccessory: "theaterMasks", heldItem: "browser" },
           instruction_sets: [],
           tools: %w[playwright],
-          mcp_servers: {
-            playwright: {
+          # An array of server entries, which is the shape agents.mcp_servers
+          # takes everywhere else (the builder's strong params permit an
+          # array). The old top-level Hash was copied onto agents verbatim and
+          # crashed ToolDiscovery for the whole workspace.
+          mcp_servers: [
+            {
+              name: "playwright",
               command: "npx",
               args: [ "-y", "@anthropic/mcp-server-playwright" ]
             }
-          },
+          ],
           model_config: { temperature: 0.2, max_tokens: 4096 },
           instructions: "You are a browser automation assistant using Playwright MCP.\n\nAvailable actions:\n- browser_navigate: Go to a URL\n- browser_snapshot: Get the accessibility tree\n- browser_click: Click on an element\n- browser_type: Type text into an input\n- browser_take_screenshot: Capture the page\n- browser_wait_for: Wait for text or element\n\nGuidelines:\n1. Always take a snapshot first to understand the page\n2. Use element refs from snapshots for interactions\n3. Wait for page loads before taking actions\n4. Handle errors gracefully\n5. Limit yourself to 10 steps maximum\n\nAlways describe what you see and what actions you're taking.",
           icon: "🎭",

data/app/models/action_agent/evaluation.rb

@@ -13,6 +13,7 @@ module ActionAgent
   class Evaluation < ApplicationRecord
     belongs_to :agent
     has_many :evaluation_runs, dependent: :destroy
+    has_many :scenarios, class_name: "EvaluationScenario", dependent: :destroy
 
     # judge_defined: the judge model authors the KPI criteria itself from the
     # agent's instructions + sample interactions on the first run, then scores
@@ -47,8 +48,66 @@ module ActionAgent
       Array(config["compare_models"]).map(&:to_s).reject(&:blank?)
     end
 
-    def run!
-      EvaluationRunnerService.call(self)
+    # A scenario evaluation replays its own prompts rather than sampling the
+    # agent's recorded generations.
+    def scenario_suite?
+      scenarios.any?
+    end
+
+    def scenario_groups
+      # The index preloads scenarios for a page of evaluations; read the
+      # loaded association there rather than querying once per suite.
+      return scenarios.filter_map { |scenario| scenario.group.presence }.uniq.sort if scenarios.loaded?
+
+      scenarios.where.not(group: [ nil, "" ]).distinct.order(:group).pluck(:group)
+    end
+
+    # Runs the evaluation. `selection` narrows a scenario evaluation to some of
+    # its scenarios (`scenario_ids`, `keys`, `group`) and/or to specific
+    # `models`; it is ignored by a generation-sampling evaluation.
+    def run!(run: nil, **selection)
+      # A run created ahead of time (run_later!) is the scenario runner's even
+      # if the suite has since lost its scenarios: it fails that run with
+      # "No scenarios selected" rather than leaving it pending forever.
+      if run || scenario_suite?
+        ScenarioEvaluationRunner.call(self, selection: selection, run: run)
+      else
+        EvaluationRunnerService.call(self)
+      end
+    end
+
+    # Creates the run now and executes it in the background, so a suite of
+    # many scenarios under several models does not have to finish inside one
+    # request. Returns the pending EvaluationRun.
+    def run_later!(**selection)
+      run = evaluation_runs.create!(status: :pending, selection: selection.deep_stringify_keys)
+      EvaluationRunJob.perform_later(id, run.id, selection.deep_stringify_keys)
+      run
+    end
+
+    # Replaces the suite with the scenarios described by +attributes+ (the
+    # ActiveAgent::Evals::ScenarioParser output). Keys already in the suite keep their records, so
+    # earlier runs' results still resolve to their scenario, and keep their
+    # enabled flag unless the attributes set it (a paste cannot).
+    def replace_scenarios!(attributes)
+      transaction do
+        keep = attributes.map { |attrs| attrs["key"] }
+        scenarios.where.not(key: keep).destroy_all
+
+        attributes.each_with_index do |attrs, index|
+          scenario = scenarios.find_or_initialize_by(key: attrs["key"])
+          scenario.assign_attributes(
+            prompt: attrs["prompt"],
+            group: attrs["group"],
+            notes: attrs["notes"],
+            expectations: attrs["expectations"] || {},
+            position: attrs.fetch("position", index),
+            enabled: attrs.fetch("enabled") { scenario.new_record? || scenario.enabled }
+          )
+          scenario.save!
+        end
+      end
+      scenarios.reload
     end
 
     def llm_criteria
@@ -60,8 +119,9 @@ module ActionAgent
     def validate_criteria
       if criteria.blank?
         # judge_defined evaluations start empty — the judge authors the KPIs
-        # on the first run.
-        errors.add(:criteria, "must include at least one criterion") unless judge_defined?
+        # on the first run — and a scenario suite is scored by its scenarios'
+        # own expectations even with no criteria.
+        errors.add(:criteria, "must include at least one criterion") unless judge_defined? || scenarios.any?
         return
       end
 

data/app/models/action_agent/evaluation_run.rb

@@ -2,19 +2,199 @@
 
 module ActionAgent
   # One execution of an Evaluation over a sample of the agent's generations.
-  # scores: { criterion_key => { "score", "min", "max", "passed", "total" } }
+  # scores: { criterion_key => { "score", "min", "max", "passed", "total" } },
+  # except on a comparison run, where each criterion is a cohort map of
+  # model => stats and "_"-prefixed metadata keys sit alongside the criteria.
+  # See #average_score, which is what has to tolerate both shapes.
   class EvaluationRun < ApplicationRecord
     belongs_to :evaluation
+    has_many :scenario_results, class_name: "EvaluationScenarioResult", dependent: :destroy
 
     enum :status, { pending: 0, running: 1, complete: 2, failed: 3 }
 
     scope :recent, -> { order(created_at: :desc) }
 
+    # Which scenarios and models a scenario run covered; empty for a
+    # generation-sampling run.
+    def selection
+      value = super
+      value.is_a?(Hash) ? value : {}
+    end
+
+    # The candidate models a scenario run compared, in the order they were
+    # requested; empty for a generation-sampling run.
+    def models
+      Array(scores&.dig("_models")&.keys)
+    end
+
+    # The label ActiveAgent::Evals::Report gives a verdict it ranked by pass
+    # rate itself, for a comparison no judge was available to rule on. Read
+    # from the framework rather than restated: the report reads it back when
+    # it names the judge, so the two have to agree on the string.
+    PASS_RATE_JUDGE = ActiveAgent::Evals::Report::PASS_RATE_JUDGE
+
+    # The verdict a comparison run recorded — the judge's pick and rationale
+    # when a judge wrote it, the framework's pass-rate ranking otherwise —
+    # as `{ "winner", "rationale", "judge" }`; nil for a single-model or
+    # generation-sampling run.
+    def recorded_verdict
+      verdict = scores&.dig("_verdict")
+      verdict.to_h.stringify_keys.presence if verdict.is_a?(Hash)
+    end
+
+    # How the report names the judge, the way the suite panel does: the
+    # judge the recorded verdict names — unless that is only the pass-rate
+    # ranking — else the evaluation's judge model. nil when neither is set,
+    # which the report reads as "rules".
+    def judge_label
+      recorded = recorded_verdict&.dig("judge").to_s
+      return recorded if recorded.present? && recorded != PASS_RATE_JUDGE
+
+      evaluation.judge_model.presence
+    end
+
+    # scores is not uniformly { criterion => stats }: a comparison run also
+    # records "_"-prefixed metadata (EvaluationRunnerService writes
+    # "_missing_models" as an Array and "_verdict"), and each of its criteria
+    # is a cohort map of model => stats rather than a single stats hash.
+    # Only real criterion scores are averaged; anything else is ignored
+    # rather than raising and taking the whole Evaluations page down.
     def average_score
-      values = scores.values.map { |s| s["score"] }.compact
+      values = (scores || {}).reject { |key, _| key.to_s.start_with?("_") }.filter_map do |_key, value|
+        criterion_score(value) if value.is_a?(Hash)
+      end
       return nil if values.empty?
 
       (values.sum.to_f / values.size).round(3)
     end
+
+    # Aggregate usage over the run's scenario results, for display after a
+    # run: estimated cost, token totals, summed model time, and the run's
+    # wall-clock runtime. Returns nil for a generation-sampling run, which
+    # replays nothing itself.
+    def usage
+      totals = scenario_results.pick(
+        Arel.sql("COUNT(*)"), Arel.sql("SUM(cost)"), Arel.sql("SUM(input_tokens)"),
+        Arel.sql("SUM(output_tokens)"), Arel.sql("SUM(duration_ms)")
+      )
+      replays = totals&.first.to_i
+      return nil if replays.zero?
+
+      {
+        replays: replays,
+        cost: totals[1]&.to_f,
+        input_tokens: totals[2].to_i,
+        output_tokens: totals[3].to_i,
+        model_time_ms: totals[4].to_i,
+        runtime_ms: completed_at.present? ? ((completed_at - created_at) * 1000).round : nil
+      }
+    end
+
+    # Route templates for the report's fix item actions, relative to the
+    # dashboard mount: `%{key}` is filled in per MCP server by the report.
+    # The JSON API leaves `mount` empty — the React app resolves paths
+    # against the mount itself (dashboardPath) — while the standalone HTML
+    # report page is served outside the app and needs the absolute path.
+    def report_links(mount: "")
+      base = mount.to_s.chomp("/")
+
+      {
+        "mcp" => "#{base}/mcp/%{key}",
+        "tools" => "#{base}/tools",
+        "instructions" => "#{base}/agents/#{evaluation.agent_id}/edit"
+      }
+    end
+
+    # What to fix, from the framework's Report: one item per fault plus one
+    # per instruction change the judge proposed, each naming the tools
+    # involved, the MCP server that serves them and whether this run's
+    # agent has it enabled (EvaluationToolResolver), and the dashboard
+    # action that addresses it. Empty for a generation-sampling run.
+    def fix_items(links: report_links)
+      to_report(links: links).fix_items
+    end
+
+    # Rebuilds the framework's Report from this run's persisted results, so
+    # the dashboard serves the same self-contained report page a CLI run
+    # writes with Report#to_html. The run's recorded verdict and judge go
+    # with it: the report is not to re-rank the rebuilt results by pass
+    # rate and show a different judge's pick, verdict or `judged by` than
+    # the suite panel does. Raises ActiveRecord::RecordNotFound via the
+    # caller for a run of a generation-sampling evaluation, which has no
+    # scenario results to report on.
+    def to_report(links: report_links)
+      rows = scenario_results.includes(:scenario).joins(:scenario)
+        .order(EvaluationScenario.arel_table[:position], EvaluationScenario.arel_table[:id], :model)
+      selected = selected_specs
+      specs = {}
+      results = rows.map do |row|
+        spec = specs[[ row.provider.to_s, row.model ]] ||= selected[[ row.provider.to_s, row.model ]] || ModelSpec.new(
+          label: [ row.provider.presence, row.model ].compact.join("/"), provider: row.provider.to_s, model: row.model
+        )
+        ActiveAgent::Evals::Result.new(
+          scenario: ActiveAgent::Evals::Scenario.from_hash(row.scenario.as_json_summary),
+          spec: spec,
+          replay: ActiveAgent::Evals::Replay.new(
+            answer: row.output, tool_calls: Array(row.tool_calls), duration_ms: row.duration_ms,
+            input_tokens: row.input_tokens, output_tokens: row.output_tokens,
+            cost: row.cost&.to_f, error: row.error_message
+          ),
+          scores: row.scores.to_h, score: row.score, status: row.status,
+          diagnosis: row.diagnosis.presence
+        )
+      end
+
+      ActiveAgent::Evals::Report.new(
+        results: results,
+        models: (selected.values & specs.values) + (specs.values - selected.values),
+        metadata: {
+          "evaluation" => evaluation.name,
+          "agent" => evaluation.agent&.name,
+          "run" => id,
+          "finished" => completed_at&.iso8601
+        }.compact,
+        verdict: recorded_verdict,
+        judge_label: judge_label,
+        tool_resolver: EvaluationToolResolver.new(evaluation.agent),
+        agent_name: evaluation.agent&.name,
+        links: links
+      )
+    end
+
+    private
+
+    ModelSpec = ActiveAgent::Evals::ModelSpec
+    private_constant :ModelSpec
+
+    # The candidate specs the run was asked to compare, keyed by
+    # [provider, model] in the order requested. ScenarioEvaluationRunner
+    # persists each ModelSpec#to_h in `selection`, and it is that label —
+    # the string the user typed, e.g. "gpt-5-mini" — that keys the run's
+    # `_models` and names the verdict's winner, so the rebuilt report has
+    # to reuse it rather than relabel every model provider/model.
+    def selected_specs
+      Array(selection["models"]).filter_map do |entry|
+        next unless entry.is_a?(Hash)
+
+        entry = entry.stringify_keys
+        next if entry["model"].blank?
+
+        ModelSpec.new(label: entry["label"].presence || entry["model"], provider: entry["provider"].to_s, model: entry["model"])
+      end.index_by { |spec| [ spec.provider, spec.model ] }
+    end
+
+    # A criterion is either scored directly ({ "score" => 0.8, ... }) or, on a
+    # comparison run, a map of model => stats; that cohort's mean is the
+    # criterion's headline score. Skipped criteria carry no score at all.
+    def criterion_score(value)
+      return value["score"] if value["score"].is_a?(Numeric)
+
+      cohort = value.each_value.filter_map do |stats|
+        stats["score"] if stats.is_a?(Hash) && stats["score"].is_a?(Numeric)
+      end
+      return nil if cohort.empty?
+
+      cohort.sum.to_f / cohort.size
+    end
   end
 end

data/app/models/action_agent/evaluation_scenario.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  # One user-authored task an evaluation replays through its agent: the
+  # message a user would send, the group of related tasks it belongs to, and
+  # what a passing answer is expected to do.
+  #
+  # `expectations` holds the scenario-level checks ScenarioEvaluationRunner
+  # scores in addition to the evaluation's criteria:
+  #
+  #   "tools"        — tool names the agent is expected to call (any one of them)
+  #   "contains"     — substrings or patterns the answer must include
+  #   "not_contains" — substrings or patterns the answer must avoid
+  #
+  # `key` is stable within the suite ("blame_3"), so results of successive
+  # runs line up by scenario even after the suite is re-imported.
+  class EvaluationScenario < ApplicationRecord
+    belongs_to :evaluation
+    has_many :results, class_name: "EvaluationScenarioResult", foreign_key: :evaluation_scenario_id,
+      dependent: :destroy, inverse_of: :scenario
+
+    validates :key, presence: true, uniqueness: { scope: :evaluation_id }
+    validates :prompt, presence: true
+
+    scope :enabled, -> { where(enabled: true) }
+    scope :ordered, -> { order(:position, :id) }
+    scope :in_group, ->(group) { where(group: group) }
+
+    def expectations
+      value = super
+      value.is_a?(Hash) ? value : {}
+    end
+
+    def expected_tools
+      Array(expectations["tools"]).map(&:to_s).reject(&:blank?)
+    end
+
+    def expected_patterns
+      Array(expectations["contains"]).map(&:to_s).reject(&:blank?)
+    end
+
+    def forbidden_patterns
+      Array(expectations["not_contains"]).map(&:to_s).reject(&:blank?)
+    end
+
+    def as_json_summary
+      {
+        id: id,
+        key: key,
+        group: group,
+        prompt: prompt,
+        notes: notes,
+        expectations: expectations,
+        position: position,
+        enabled: enabled
+      }
+    end
+  end
+end

data/app/models/action_agent/evaluation_scenario_result.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  # What one scenario produced under one model in one evaluation run: the
+  # AgentRun that replayed it, the answer, the tools it called, its score per
+  # criterion, and — when it fell short — the fault and the recommended fix.
+  #
+  # `fault` is one of FAULTS; `diagnosis` carries the evidence behind it and,
+  # when a judge was available, its suggested tool or instruction change.
+  class EvaluationScenarioResult < ApplicationRecord
+    belongs_to :evaluation_run
+    belongs_to :scenario, class_name: "EvaluationScenario", foreign_key: :evaluation_scenario_id, inverse_of: :results
+    belongs_to :agent_run, optional: true
+
+    enum :status, { pending: 0, passed: 1, failed: 2, errored: 3 }
+
+    # Why a scenario did not pass, from the most mechanical cause to the
+    # least; ActiveAgent::Evals::Diagnosis assigns exactly one per failing result.
+    FAULTS = ActiveAgent::Evals::Diagnosis::FAULTS
+
+    validates :model, presence: true
+    validates :fault, inclusion: { in: FAULTS }, allow_nil: true
+
+    scope :for_model, ->(model) { where(model: model) }
+    scope :faulted, -> { where.not(fault: nil) }
+
+    def tool_calls
+      value = super
+      value.is_a?(Array) ? value : []
+    end
+
+    def tool_names
+      tool_calls.filter_map { |call| call.is_a?(Hash) ? (call["name"] || call[:name]) : call }.map(&:to_s)
+    end
+
+    def tool_errors
+      tool_calls.select { |call| call.is_a?(Hash) && (call["error"] || call[:error]) }
+    end
+
+    def as_json_summary
+      {
+        id: id,
+        scenario_id: evaluation_scenario_id,
+        scenario_key: scenario.key,
+        group: scenario.group,
+        prompt: scenario.prompt,
+        model: model,
+        provider: provider,
+        status: status,
+        score: score,
+        scores: scores,
+        output: output,
+        tool_calls: tool_calls,
+        duration_ms: duration_ms,
+        input_tokens: input_tokens,
+        output_tokens: output_tokens,
+        cost: cost&.to_f,
+        fault: fault,
+        recommendation: recommendation,
+        diagnosis: diagnosis,
+        error_message: error_message,
+        agent_run_id: agent_run_id
+      }
+    end
+  end
+end

data/app/models/action_agent/recording_action.rb

@@ -75,14 +75,23 @@ module ActionAgent
       }
     end
 
-    private
-
+    # The value with passwords, card numbers and the like masked. Public so
+    # every read path — /actions, the show timeline, and the export
+    # cassette — serializes through the one redaction rule.
     def redacted_value
       return value unless should_redact?
 
       "[REDACTED]"
     end
 
+    # Metadata with the sensitive keys removed. Public for the same reason.
+    def safe_metadata
+      # Remove any sensitive data from metadata
+      metadata.except("password", "credit_card", "cvv", "ssn")
+    end
+
+    private
+
     def should_redact?
       return false unless value.present?
 
@@ -102,11 +111,6 @@ module ActionAgent
       selector_is_sensitive || value_is_sensitive
     end
 
-    def safe_metadata
-      # Remove any sensitive data from metadata
-      metadata.except("password", "credit_card", "cvv", "ssn")
-    end
-
     def extract_url
       case action_type
       when "navigate"

data/app/models/action_agent/sandbox_session.rb

@@ -48,7 +48,7 @@ module ActionAgent
     # Unknown keys are dropped rather than raising — a session outlives a
     # catalog edit.
     def mcp_catalog_entries
-      Array(mcp_servers).filter_map { |key| McpCatalog.find(key) }
+      Array(mcp_servers).filter_map { |key| MCPCatalog.find(key) }
     end
 
     # Check if session is still valid

data/app/models/action_agent/session_recording.rb

@@ -31,20 +31,30 @@ module ActionAgent
       name&.start_with?("user_takeover_")
     end
 
-    # Start a new recording session
-    def self.start!(agent_run: nil, sandbox_session: nil, name: nil)
-      create!(
+    # Start a new recording session.
+    #
+    # The owner column is written here, at creation: the index and recent
+    # endpoints scope through it, and a recording nothing ever stamped was
+    # invisible in the list to the very person who made it. An explicit
+    # +owner+ wins; otherwise the recording inherits the owner of the sandbox
+    # or agent it records. Ownable#owner= is a no-op in a single-user
+    # install, where nothing is owned.
+    def self.start!(agent_run: nil, sandbox_session: nil, name: nil, owner: nil)
+      recording = new(
         agent_run: agent_run,
         sandbox_session: sandbox_session,
         name: name || generate_name(agent_run, sandbox_session),
         status: :recording,
         metadata: { started_at: Time.current.iso8601 }
       )
+      recording.owner = owner || inherited_owner(agent_run, sandbox_session)
+      recording.save!
+      recording
     end
 
     # Start a user takeover session (for lander demo analytics)
-    def self.start_user_session!(visitor_id: nil, parent_demo_id: nil, page_url: nil)
-      create!(
+    def self.start_user_session!(visitor_id: nil, parent_demo_id: nil, page_url: nil, owner: nil)
+      recording = new(
         name: "user_takeover_#{Time.current.strftime('%Y%m%d_%H%M%S')}_#{SecureRandom.hex(4)}",
         status: :recording,
         metadata: {
@@ -56,6 +66,16 @@ module ActionAgent
           user_agent: nil # Will be set from request
         }
       )
+      recording.owner = owner
+      recording.save!
+      recording
+    end
+
+    # Whoever owns the sandbox or agent a recording is made against. Both
+    # models declare the same owner candidates as this one, so the record
+    # they hand back is of the class this install owns things through.
+    def self.inherited_owner(agent_run, sandbox_session)
+      sandbox_session&.owner || agent_run&.agent&.owner
     end
 
     # Record a browser action
@@ -112,7 +132,10 @@ module ActionAgent
       )
     end
 
-    # Get timeline data for playback
+    # Get timeline data for playback. Values and metadata go through the
+    # same redaction the /actions endpoint applies: this is what #show
+    # renders, and it used to hand back the cleartext password that
+    # /actions had just redacted for the same action.
     def timeline
       recording_actions.order(:sequence).map do |action|
         {
@@ -121,9 +144,9 @@ module ActionAgent
           sequence: action.sequence,
           timestamp_ms: action.timestamp_ms,
           selector: action.selector,
-          value: action.value,
+          value: action.redacted_value,
           screenshot_key: action.screenshot_key,
-          metadata: action.metadata
+          metadata: action.safe_metadata
         }
       end
     end