actionagent 1.2.2 → 1.5.0

data/app/controllers/action_agent/api/agent_runs_controller.rb

@@ -28,7 +28,7 @@ module ActionAgent
       def index
         # Scoped to the caller's own agents: this listed (and counted) every
         # run in the database regardless of who owned it.
-        scope = AgentRun.includes(:agent).where(agent: owner_agents).recent
+        scope = AgentRun.includes(:agent).with_attachments.where(agent: owner_agents).recent
 
         scope = scope.where(agent_id: params[:agent_id]) if params[:agent_id].present?
         scope = scope.where(status: params[:status]) if params[:status].present?
@@ -63,13 +63,7 @@ module ActionAgent
       def interaction_messages(run)
         return [] if run.trace_id.blank?
 
-        context = AgentContext.for_agents(Agent.where(id: run.agent_id)).order(created_at: :desc).first
-        return [] unless context
-
-        messages = context.messages.chronological.to_a
-        start_index = messages.index do |message|
-          message.role == "user" && message.provenance&.dig("trace_id") == run.trace_id
-        end
+        messages, start_index = run_slice_start(run)
         return [] unless start_index
 
         slice = [ messages[start_index] ]
@@ -93,6 +87,30 @@ module ActionAgent
         serialized
       end
 
+      # solid_agent keys the persisted context by action_name, so each action
+      # has its own stream. The run's own action is searched first; a run
+      # whose action is blank or legacy (or whose trace landed in another
+      # stream) falls back to every context of the agent, newest first.
+      # Picking only the newest context regardless of action left the
+      # conversation empty for every run of any other action.
+      def run_slice_start(run)
+        contexts = AgentContext.for_agents(Agent.where(id: run.agent_id)).order(created_at: :desc)
+        action = run.action_name.presence || run.output_metadata&.dig("action").presence || Agent::DEFAULT_ACTION
+
+        candidates = contexts.for_action(action).to_a
+        candidates += contexts.to_a.reject { |context| candidates.include?(context) }
+
+        candidates.each do |context|
+          messages = context.messages.chronological.to_a
+          start_index = messages.index do |message|
+            message.role == "user" && message.provenance&.dig("trace_id") == run.trace_id
+          end
+          return [ messages, start_index ] if start_index
+        end
+
+        [ [], nil ]
+      end
+
       def run_json(run, include_agent: false)
         json = {
           id: run.id,
@@ -107,6 +125,8 @@ module ActionAgent
           total_tokens: run.total_tokens,
           error_message: run.error_message,
           trace_id: run.trace_id,
+          attachments: run.attachment_manifest,
+          context_id: run.context_id,
           logs: run.logs,
           started_at: run.started_at,
           completed_at: run.completed_at,

data/app/controllers/action_agent/api/agents_controller.rb

@@ -3,6 +3,8 @@
 module ActionAgent
   module Api
     class AgentsController < BaseController
+      include AgentSerialization
+
       # Ranking for the agent cards. Every dimension except "recent" reads the
       # scorecard, which is computed in Ruby over both execution sources, so
       # the ordering is applied there rather than in the SQL scope.
@@ -14,11 +16,23 @@ module ActionAgent
         "tokens" => "Most tokens"
       }.freeze
       DEFAULT_LIST_SORT = "recent"
-
-      before_action :set_agent, only: [ :show, :update, :destroy, :versions, :runs, :execute, :test, :restore, :duplicate, :export, :analytics ]
+      # Conversations returned to the runner's picker when no limit is asked for.
+      CONVERSATIONS_LIMIT = 50
+      # Keywords Agent#execute takes in its own right, which per-run overrides
+      # must never supply (see #execution_params).
+      RESERVED_EXECUTION_KEYS = [ :attachments, :action ].freeze
+
+      before_action :set_agent, only: [
+        :show, :update, :destroy, :versions, :runs, :execute, :test, :restore, :duplicate, :export, :analytics,
+        :conversations, :create_conversation
+      ]
       before_action :require_execution_enabled!, only: [ :execute, :test ]
       before_action :require_owner!, only: [ :execute, :test ]
+      before_action :require_executable_agent!, only: [ :execute, :test, :update, :restore, :create_conversation ]
       before_action :enforce_execution_quota!, only: [ :execute, :test ]
+      before_action :require_prompt!, only: [ :execute, :test ]
+
+      rescue_from AgentRun::AttachmentsUnavailable, with: :attachments_unavailable
 
       # GET /api/agents
       def index
@@ -62,7 +76,7 @@ module ActionAgent
         render json: {
           agent: agent_json(@agent, include_details: true),
           versions: @agent.agent_versions.recent.limit(10).map { |v| version_json(v) },
-          recent_runs: @agent.agent_runs.recent.limit(5).map(&:summary)
+          recent_runs: @agent.agent_runs.with_attachments.recent.limit(5).map(&:summary)
         }
       end
 
@@ -131,7 +145,7 @@ module ActionAgent
         # One digest->version map for the page; labels each run's instructions
         # with the agent version that introduced them where one matches.
         digest_versions = @agent.instructions_digest_versions
-        runs_by_id = AgentRun.where(id: executions[:rows].select { |r| r.source == "dashboard" }.map(&:id))
+        runs_by_id = AgentRun.with_attachments.where(id: executions[:rows].select { |r| r.source == "dashboard" }.map(&:id))
           .index_by(&:id)
 
         render json: {
@@ -147,11 +161,16 @@ module ActionAgent
       end
 
       # POST /api/agents/:id/execute
+      #
+      # JSON as before, or multipart from the runner's composer: the new
+      # user message, its files (attachments[]) and the conversation to
+      # continue (params[context_id], or a top-level context_id).
       def execute
         run = @agent.execute(
-          params[:prompt],
+          execution_prompt,
           action: params[:action_name],
-          **params.fetch(:params, {}).to_unsafe_h.symbolize_keys
+          attachments: uploaded_attachments,
+          **execution_params
         )
         record_execution_usage
 
@@ -161,15 +180,54 @@ module ActionAgent
       # POST /api/agents/:id/test
       def test
         run = @agent.test_execute(
-          params[:prompt],
+          execution_prompt,
           action: params[:action_name],
-          **params.fetch(:params, {}).to_unsafe_h.symbolize_keys
+          attachments: uploaded_attachments,
+          **execution_params
         )
         record_execution_usage
 
         render json: { run: run.summary, output: run.output }
       end
 
+      # GET /api/agents/:id/conversations
+      #
+      # The agent's persisted contexts, newest first — the runner's
+      # conversation picker, narrowed to one action when asked.
+      def conversations
+        limit = params.fetch(:limit, CONVERSATIONS_LIMIT).to_i.clamp(1, 200)
+        contexts = agent_contexts.order(created_at: :desc)
+        contexts = contexts.for_action(params[:action_name]) if params[:action_name].present?
+        # The picker is refetched on every seeded or deleted message, and the
+        # list grows a row per New conversation, so it is bounded like every
+        # other collection this API serves.
+        contexts = contexts.limit(limit).to_a
+        counts = AgentMessage.where(agent_context_id: contexts.map(&:id)).group(:agent_context_id).count
+
+        render json: {
+          conversations: contexts.map { |context| conversation_json(context, counts[context.id] || 0) }
+        }
+      end
+
+      # POST /api/agents/:id/conversations
+      #
+      # Starts an empty context for an action, so the runner's very first
+      # message already lands in a pinned conversation rather than in the
+      # agent's default stream.
+      def create_conversation
+        action = params[:action_name].presence || Agent::DEFAULT_ACTION
+        action = Agent::DEFAULT_ACTION unless @agent.available_actions.include?(action)
+
+        context = AgentContext.create!(
+          contextable: @agent,
+          agent_name: @agent.telemetry_agent_class,
+          action_name: action,
+          instructions: @agent.composed_instructions_for(action)
+        )
+
+        render json: { conversation: conversation_json(context, 0) }, status: :created
+      end
+
       # POST /api/agents/:id/duplicate
       def duplicate
         new_agent = @agent.dup
@@ -199,37 +257,82 @@ module ActionAgent
       end
 
       # GET /api/agents/:id/analytics
+      #
+      # Every execution of this agent, whoever ran it — the same merged model
+      # the runs list and the scorecard use. Agents observed from telemetry
+      # have no AgentRun rows at all, so a runs-only aggregate showed them
+      # with all-zero metrics beside a card and a runs list reporting real
+      # traffic.
       def analytics
         days = (params[:days] || 30).to_i
         start_date = days.days.ago.beginning_of_day
 
         runs = @agent.agent_runs.where("created_at >= ?", start_date)
+        traces = AgentExecutions.unclaimed_traces([ @agent.id ], since: start_date, owner: current_owner)
+        traces_table = ActionAgent.trace_model.table_name
+        trace_tokens_sql = Arel.sql(
+          "COALESCE(#{traces_table}.total_input_tokens, 0) + COALESCE(#{traces_table}.total_output_tokens, 0) + " \
+          "COALESCE(#{traces_table}.total_thinking_tokens, 0)"
+        )
 
-        # Calculate stats
-        total_runs = runs.count
+        # Dashboard runs
+        run_count = runs.count
         completed_runs = runs.where(status: :complete).count
         failed_runs = runs.where(status: :failed).count
-        avg_duration = runs.where.not(duration_ms: nil).average(:duration_ms)&.round || 0
-        total_tokens = runs.sum(:total_tokens)
+        timed_runs = runs.where.not(duration_ms: nil)
+        run_tokens = runs.sum(:total_tokens)
+
+        # Reported executions
+        trace_count = traces.count
+        trace_failures = traces.where(status: "ERROR").count
+        timed_traces = traces.where.not(total_duration_ms: nil)
+        trace_tokens = traces.sum(trace_tokens_sql)
+
+        total_runs = run_count + trace_count
+        completed_runs += trace_count - trace_failures
+        failed_runs += trace_failures
+        total_tokens = run_tokens + trace_tokens
         avg_tokens = total_runs > 0 ? (total_tokens.to_f / total_runs).round : 0
 
-        # Runs by day
-        runs_by_day = runs.group("DATE(created_at)")
+        # Weighted across both sources, so one side's long tail counts for
+        # what it is.
+        timed_total = timed_runs.count + timed_traces.count
+        avg_duration = if timed_total.positive?
+          (timed_runs.sum(:duration_ms) + timed_traces.sum(:total_duration_ms)).to_f / timed_total
+        else
+          0
+        end.round
+
+        # Runs by day, zero-filled across the window (see AnalyticsController)
+        by_day = Hash.new { |hash, date| hash[date] = { date: date, count: 0, tokens: 0 } }
+        runs.group("DATE(created_at)")
           .select("DATE(created_at) as date, COUNT(*) as count, SUM(total_tokens) as tokens")
-          .order("date")
-          .map { |r| { date: r.date.to_s, count: r.count, tokens: r.tokens || 0 } }
+          .each { |r| by_day[r.date.to_s].merge!(count: r.count, tokens: r.tokens || 0) }
+        trace_day_sql = Arel.sql("DATE(#{traces_table}.timestamp)")
+        trace_counts = traces.group(trace_day_sql).count
+        trace_token_sums = traces.group(trace_day_sql).sum(trace_tokens_sql)
+        trace_counts.each do |date, count|
+          bucket = by_day[date.to_s]
+          bucket[:count] += count
+          bucket[:tokens] += trace_token_sums[date].to_i
+        end
+        runs_by_day = (start_date.to_date..Date.current).map { |day| by_day[day.to_s] }
 
-        # Status breakdown
+        # Status breakdown. A reported execution is complete unless its trace
+        # errored; those are the only two states a trace can be in.
         status_breakdown = runs.group(:status).count.transform_keys(&:to_s)
+        status_breakdown["complete"] = status_breakdown.fetch("complete", 0) + (trace_count - trace_failures)
+        status_breakdown["failed"] = status_breakdown.fetch("failed", 0) + trace_failures
+        status_breakdown.delete_if { |_status, count| count.zero? }
 
-        # Recent errors
+        # Recent errors, from both sources
         recent_errors = runs.failed_runs.recent.limit(5).map do |run|
-          {
-            id: run.id,
-            error: run.error_message&.truncate(200),
-            created_at: run.created_at
-          }
+          { id: run.id, source: "dashboard", error: run.error_message&.truncate(200), created_at: run.created_at }
         end
+        recent_errors += traces.where(status: "ERROR").order(timestamp: :desc).limit(5).map do |trace|
+          { id: "trace-#{trace.id}", source: "reported", error: trace.error_message&.truncate(200), created_at: trace.timestamp }
+        end
+        recent_errors = recent_errors.sort_by { |row| row[:created_at] }.reverse.first(5)
 
         render json: {
           period_days: days,
@@ -265,6 +368,71 @@ module ActionAgent
 
       private
 
+      # Observed agents were discovered from reported telemetry; the platform
+      # has no configuration to run them with (a placeholder model, no
+      # instructions), so executing one only manufactured a failed run that
+      # was then blended into the clean scorecard its telemetry had built.
+      # Duplicating an observed agent yields a draft that can be run.
+      def require_executable_agent!
+        return unless @agent.observed?
+
+        render json: {
+          error: "Observed agents are read-only — duplicate this agent to create an executable copy"
+        }, status: :unprocessable_entity
+      end
+
+      # A message may be empty only when files carry the request.
+      def require_prompt!
+        return if params[:prompt].present? || uploaded_attachments.any?
+
+        render json: { error: "Prompt can't be blank unless files are attached" }, status: :unprocessable_entity
+      end
+
+      def execution_prompt
+        params[:prompt].presence || "(see attached files)"
+      end
+
+      # Multipart files only: a JSON body can't carry one, and an empty file
+      # input arrives as a blank string.
+      def uploaded_attachments
+        @uploaded_attachments ||= Array(params[:attachments]).select { |file| file.respond_to?(:original_filename) }
+      end
+
+      # Per-run overrides (provider/model overrides, the pinned context)
+      # for input_params. context_id is stored as an integer so the JSON
+      # column reads the same whether a form or a JSON body delivered it;
+      # anything that isn't one is dropped rather than pinned to nothing.
+      def execution_params
+        extra = params.fetch(:params, {}).to_unsafe_h.symbolize_keys
+        # These reach Agent#execute as keywords, and a keyword splat wins over
+        # the arguments before it: left in, params[params][attachments] would
+        # replace the uploaded files with anything the caller names, and
+        # params[params][action] the action. They are the controller's to set.
+        extra.except!(*RESERVED_EXECUTION_KEYS)
+        context_id = Integer(extra.delete(:context_id).presence || params[:context_id].presence || 0, exception: false)
+        extra[:context_id] = context_id if context_id&.positive?
+        extra
+      end
+
+      def attachments_unavailable(exception)
+        render json: { error: exception.message }, status: :unprocessable_entity
+      end
+
+      def agent_contexts
+        AgentContext.where(contextable: @agent)
+      end
+
+      def conversation_json(context, message_count)
+        {
+          id: context.id,
+          action_name: context.action_name,
+          agent_name: context.agent_name,
+          message_count: message_count,
+          last_activity_at: context.updated_at.iso8601,
+          created_at: context.created_at.iso8601
+        }
+      end
+
       def list_sort(requested)
         LIST_SORTS.key?(requested.to_s) ? requested.to_s : DEFAULT_LIST_SORT
       end
@@ -323,39 +491,6 @@ module ActionAgent
         )
       end
 
-      def agent_json(agent, include_details: false)
-        json = {
-          id: agent.id,
-          name: agent.name,
-          slug: agent.slug,
-          description: agent.description,
-          provider: agent.provider,
-          model: agent.model,
-          status: agent.status,
-          preset_type: agent.preset_type,
-          appearance: agent.appearance,
-          version_count: agent.version_count,
-          created_at: agent.created_at,
-          updated_at: agent.updated_at
-        }
-
-        if include_details
-          json.merge!(
-            instructions: agent.instructions,
-            action_prompts: agent.action_prompts,
-            instruction_sets: agent.instruction_sets,
-            tools: agent.tools,
-            mcp_servers: agent.mcp_servers,
-            model_config: agent.model_config,
-            response_format: agent.response_format,
-            agent_class_name: agent.agent_class_name,
-            telemetry_agent_class: agent.telemetry_agent_class
-          )
-        end
-
-        json
-      end
-
       def version_json(version, include_diff: false)
         json = {
           id: version.id,

data/app/controllers/action_agent/api/analytics_controller.rb

@@ -32,17 +32,26 @@ module ActionAgent
         avg_duration = runs.where.not(duration_ms: nil).average(:duration_ms)&.round || 0
         avg_tokens_per_run = total_runs > 0 ? (total_tokens.to_f / total_runs).round : 0
 
-        # Runs over time
-        runs_by_day = runs.group("DATE(#{runs_table}.created_at)")
-          .select("DATE(#{runs_table}.created_at) as date, COUNT(*) as count")
-          .order("date")
-          .map { |r| { date: r.date.to_s, count: r.count } }
+        # Runs over time. Zero-filled across the window: grouping only
+        # returns days that have rows, and the chart draws whatever it gets
+        # as adjacent bars, so a 30-day window with runs on two far-apart
+        # days rendered as two neighbouring bars.
+        runs_by_day = zero_filled_days(
+          start_date,
+          runs.group("DATE(#{runs_table}.created_at)")
+            .select("DATE(#{runs_table}.created_at) as date, COUNT(*) as count")
+            .map { |r| { date: r.date.to_s, count: r.count } },
+          count: 0
+        )
 
         # Token usage over time
-        tokens_by_day = runs.group("DATE(#{runs_table}.created_at)")
-          .select("DATE(#{runs_table}.created_at) as date, SUM(total_tokens) as tokens")
-          .order("date")
-          .map { |r| { date: r.date.to_s, tokens: r.tokens || 0 } }
+        tokens_by_day = zero_filled_days(
+          start_date,
+          runs.group("DATE(#{runs_table}.created_at)")
+            .select("DATE(#{runs_table}.created_at) as date, SUM(total_tokens) as tokens")
+            .map { |r| { date: r.date.to_s, tokens: r.tokens || 0 } },
+          tokens: 0
+        )
 
         # Top agents by usage
         top_agents = agents.joins(:agent_runs)
@@ -89,6 +98,19 @@ module ActionAgent
           provider_breakdown: provider_breakdown
         }
       end
+
+      private
+
+      # One entry per calendar day from +start_date+ through today, in
+      # order, with +defaults+ for the days the grouped +rows+ did not
+      # mention. Keyed on the ISO date string so it reads the same whether
+      # the adapter returns DATE() as a Date or a String.
+      def zero_filled_days(start_date, rows, **defaults)
+        by_date = rows.index_by { |row| row[:date] }
+        (start_date.to_date..Date.current).map do |day|
+          by_date[day.to_s] || defaults.merge(date: day.to_s)
+        end
+      end
     end
   end
 end

data/app/controllers/action_agent/api/base_controller.rb

@@ -20,9 +20,25 @@ module ActionAgent
       rescue_from ActiveRecord::RecordNotFound, with: :not_found
       rescue_from ActiveRecord::RecordInvalid, with: :unprocessable_entity
       rescue_from ActionController::ParameterMissing, with: :bad_request
+      rescue_from ActiveRecord::Encryption::Errors::Configuration, with: :encryption_unconfigured
 
       private
 
+      # API keys and provider credentials are encrypted at rest, which needs
+      # Active Record Encryption keys. The engine derives fallback keys when
+      # the host set none (see Engine's action_agent.active_record_encryption
+      # initializer), so this is only reached when that fallback was disabled
+      # or the host's own keys are broken — in which case the operator gets
+      # told what to do rather than an HTML 500 the Settings view collapses
+      # into "Could not create the API key."
+      def encryption_unconfigured(exception)
+        render json: {
+          error: "Active Record encryption is not configured (#{exception.message}). " \
+                 "Run `rails db:encryption:init` and add the keys to your credentials, " \
+                 "or set ActionAgent.encrypt_credentials = false to store credentials unencrypted."
+        }, status: :service_unavailable
+      end
+
       # Scopes +relation+ to the caller, following the model's own
       # declaration. Unowned models (a single-user install, or a model that
       # nothing owns) come back unfiltered.

data/app/controllers/action_agent/api/dashboard_assistant_controller.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  module Api
+    class DashboardAssistantController < BaseController
+      protect_from_forgery with: :exception
+
+      before_action :require_assistant_enabled!
+      before_action :require_owner!
+      before_action :require_execution_enabled!, only: :create
+      before_action :enforce_execution_quota!, only: :create
+
+      rescue_from DashboardAssistantService::InvalidInput, with: :invalid_input
+      rescue_from DashboardAssistantService::ProcessingConsentRequired, with: :processing_consent_required
+      rescue_from DashboardAssistantService::SetupRequired, with: :setup_required
+      # Rails 8.2 verifies forgery protection from the browser's Sec-Fetch-Site
+      # header, renamed the failure to InvalidCrossOriginRequest, and deprecated
+      # the old name. Rescue whichever names the running Rails defines, so a
+      # rejected request answers with the dashboard's JSON either way.
+      # const_defined? does not fire the deprecation the bare constant would.
+      rescue_from ActionController::InvalidCrossOriginRequest, with: :invalid_authenticity_token
+      if ActionController.const_defined?(:InvalidAuthenticityToken, false)
+        rescue_from ActionController::InvalidAuthenticityToken, with: :invalid_authenticity_token
+      end
+
+      def show
+        render json: DashboardAssistantService.new(owner: current_owner).configuration
+      end
+
+      def create
+        input = params.to_unsafe_h.symbolize_keys.slice(:message, :history, :provider, :model, :allow_provider_processing)
+        assistant = DashboardAssistantService.new(owner: current_owner, **input)
+        assistant.validate!
+        record_execution_usage
+        render json: assistant.call
+      rescue StandardError => exception
+        raise if exception.is_a?(DashboardAssistantService::InvalidInput) ||
+          exception.is_a?(DashboardAssistantService::ProcessingConsentRequired) ||
+          exception.is_a?(DashboardAssistantService::SetupRequired) ||
+          exception.is_a?(ActiveRecord::Encryption::Errors::Configuration)
+
+        # Provider exceptions can contain credentials or raw request bodies.
+        Rails.logger.warn("[DashboardAssistant] Generation failed (#{exception.class.name})")
+        render json: { error: "The assistant could not complete this request. Retry, or ask the dashboard administrator to check the server logs.", code: "generation_failed" }, status: :bad_gateway
+      end
+
+      private
+
+      # The assistant ships as a development and CI tool (see
+      # ActionAgent.assistant_enabled). Where it is off, it is not a view a
+      # caller can reach by knowing the route: the dashboard omits it, and
+      # both endpoints refuse.
+      def require_assistant_enabled!
+        return if ActionAgent.assistant_enabled?
+
+        render json: {
+          error: "The dashboard assistant is available in development and test. " \
+            "Set ActionAgent.assistant_enabled = true to enable it in this environment.",
+          code: "assistant_disabled"
+        }, status: :forbidden
+      end
+
+      def invalid_input(exception)
+        render json: { error: exception.message, code: "invalid_input" }, status: :unprocessable_entity
+      end
+
+      def processing_consent_required(exception)
+        render json: { error: exception.message, code: "processing_consent_required" }, status: :unprocessable_entity
+      end
+
+      def setup_required(exception)
+        render json: {
+          error: exception.message, code: "setup_required", setup_required: true,
+          action: { type: "open_settings", path: "/settings", label: "Configure provider" }
+        }, status: :service_unavailable
+      end
+
+      def invalid_authenticity_token
+        render json: { error: "Refresh the dashboard before sending another message", code: "invalid_csrf_token" }, status: :unprocessable_entity
+      end
+    end
+  end
+end