actionagent 1.2.2 → 1.5.0

data/app/controllers/action_agent/api/sandboxes_controller.rb

@@ -51,6 +51,12 @@ module ActionAgent
         sandbox.update!(status: :running)
         comparison_id = SecureRandom.uuid
 
+        # One execution per provider. Recorded before the jobs are enqueued,
+        # mirroring #run's record-before-enqueue order, so usage is counted
+        # even if a later enqueue raises. Without this the quota gate on
+        # compare was checked but never advanced: comparisons were free.
+        providers.size.times { record_execution_usage }
+
         # Spawn a separate generation job for each provider (all in same sandbox)
         runs = providers.map do |provider|
           run_id = SecureRandom.uuid

data/app/controllers/action_agent/api/session_recordings_controller.rb

@@ -16,10 +16,10 @@ module ActionAgent
       # GET /api/session_recordings
       # List recordings with optional filters
       def index
-        # Recordings the caller owns, plus the shared demo. Ownership is a
-        # real column rather than a JSON metadata key, so this works on
+        # Recordings the caller can reach, plus the shared demo. Ownership is
+        # a real column rather than a JSON metadata key, so this works on
         # every adapter.
-        recordings = owned(SessionRecording).or(SessionRecording.where(name: "lander_demo")).recent
+        recordings = reachable_recordings.or(SessionRecording.where(name: "lander_demo")).recent
 
         # Filter by status
         recordings = recordings.where(status: params[:status]) if params[:status].present?
@@ -57,7 +57,7 @@ module ActionAgent
       # GET /api/session_recordings/recent
       # Get recent recordings for the current user
       def recent
-        recordings = owned(SessionRecording).recent.limit(10)
+        recordings = reachable_recordings.recent.limit(10)
 
         render json: {
           recordings: recordings.map { |r| recording_summary(r) }
@@ -132,14 +132,17 @@ module ActionAgent
         recording = SessionRecording.start_user_session!(
           visitor_id: params[:visitor_id] || generate_visitor_id,
           parent_demo_id: params[:parent_demo_id],
-          page_url: params[:page_url]
+          page_url: params[:page_url],
+          owner: current_owner
         )
 
-        # Set user agent from request
+        # Set user agent from request. String keys: the stored metadata is
+        # string-keyed, and merging symbols wrote a second "user_agent" that
+        # json 3.0 refuses to encode.
         recording.update!(
           metadata: recording.metadata.merge(
-            user_agent: request.user_agent,
-            ip_hash: Digest::SHA256.hexdigest(request.remote_ip.to_s)[0..16]
+            "user_agent" => request.user_agent,
+            "ip_hash" => Digest::SHA256.hexdigest(request.remote_ip.to_s)[0..16]
           )
         )
 
@@ -226,8 +229,10 @@ module ActionAgent
           return
         end
 
-        # Create a new recording for the user's continuation
-        continuation = SessionRecording.create!(
+        # Create a new recording for the user's continuation. It records the
+        # caller's own session, so it is owned by the caller — through the
+        # owner column the list reads, not a metadata key it never consults.
+        continuation = SessionRecording.new(
           sandbox_session: @recording.sandbox_session,
           agent_run: @recording.agent_run,
           name: "#{@recording.name}_continuation",
@@ -239,6 +244,8 @@ module ActionAgent
             user_id: current_user&.id
           }
         )
+        continuation.owner = current_owner || @recording.owner
+        continuation.save!
 
         render json: {
           handoff_state: handoff_state,
@@ -275,6 +282,19 @@ module ActionAgent
         not_found
       end
 
+      # What the list shows: recordings the caller owns, plus recordings made
+      # inside a sandbox the caller owns — the same reachability
+      # can_manage_recording? grants to a direct read, so a recording never
+      # opens by id while missing from the list. The second clause is what
+      # keeps recordings created before the owner column was written
+      # reachable.
+      def reachable_recordings
+        scope = owned(SessionRecording)
+        return scope if SessionRecording.owner_association.nil?
+
+        scope.or(SessionRecording.where(sandbox_session_id: owned(SandboxSession).select(:id)))
+      end
+
       def can_manage_recording?(recording)
         # An install with no owner model owns everything it can see.
         return true if SessionRecording.owner_association.nil?
@@ -346,8 +366,10 @@ module ActionAgent
               sequence: action.sequence,
               timestamp_ms: action.timestamp_ms,
               selector: action.selector,
-              value: action.value,
-              metadata: action.metadata
+              # Redacted like /actions: the export used to ship the cleartext
+              # the action list had masked.
+              value: action.redacted_value,
+              metadata: action.safe_metadata
             }
           end
         }

data/app/controllers/action_agent/api/templates_controller.rb

@@ -3,13 +3,24 @@
 module ActionAgent
   module Api
     class TemplatesController < BaseController
+      include AgentSerialization
+
       # No anonymous exemption: #show looks a template up by bare id, so the
       # exemption served unpublished drafts and private prompt libraries to
       # anyone walking the id space. #index was already limited to public
       # templates; #show was not.
 
+      before_action :require_owner!, only: [ :use ]
+
       # GET /api/templates
       def index
+        # The library ships with the engine but nothing ever seeded it, so a
+        # fresh install showed "No templates found" behind every Browse
+        # Templates button. seed_defaults! is idempotent (find_or_create_by!
+        # on slug), so an empty table is seeded on first read; the
+        # action_agent:seed_templates task does the same on demand.
+        AgentTemplate.seed_defaults! if AgentTemplate.none?
+
         @templates = AgentTemplate.public_templates.order(usage_count: :desc)
 
         # Filter by category
@@ -31,16 +42,23 @@ module ActionAgent
       end
 
       # POST /api/templates/:id/use
+      #
+      # Built through the engine's ownership layer (owner_agents, as
+      # AgentsController#create does) rather than the host user's `agents`
+      # association: a single-user install has no user, and the old
+      # `current_user.agents.build` raised NoMethodError on nil for every
+      # click of "Use This Template".
       def use
         @template = AgentTemplate.find(params[:id])
+        agent = @template.build_agent_in(owner_agents, name: params[:name])
 
-        agent = @template.create_agent_for(
-          current_user,
-          name: params[:name] || @template.name
-        )
-
-        if agent.persisted?
-          render json: { agent: agent_json(agent) }, status: :created
+        if agent.save
+          @template.increment!(:usage_count)
+          # The detail shape, not a summary: the dashboard opens the new agent
+          # in the editor straight from this response, and an editor seeded
+          # from a summary saved empty instructions/tools/model_config over
+          # the template's real ones.
+          render json: { agent: agent_json(agent, include_details: true) }, status: :created
         else
           render json: { errors: agent.errors.full_messages }, status: :unprocessable_entity
         end
@@ -75,20 +93,6 @@ module ActionAgent
 
         json
       end
-
-      def agent_json(agent)
-        {
-          id: agent.id,
-          name: agent.name,
-          slug: agent.slug,
-          description: agent.description,
-          provider: agent.provider,
-          model: agent.model,
-          status: agent.status,
-          preset_type: agent.preset_type,
-          appearance: agent.appearance
-        }
-      end
     end
   end
 end

data/app/controllers/action_agent/api/traces_controller.rb

@@ -36,14 +36,18 @@ module ActionAgent
     class TracesController < ActionController::API
       before_action :authenticate_api_key!, if: -> { ActionAgent.multi_tenant? }
       before_action :authenticate_ingest_key!, unless: -> { ActionAgent.multi_tenant? }
-
-      # Maximum traces accepted per request (mirrors
-      # ProcessTelemetryTracesJob::MAX_TRACES_PER_JOB).
-      MAX_TRACES_PER_REQUEST = 100
+      before_action :enforce_ingest_quota!
 
       # POST <mount>/api/traces  (e.g. /activeagents/api/traces)
+      #
+      # Every trace in the request is accepted. The reporter flushes its
+      # whole buffer once it reaches batch_size (which is configurable), so
+      # a single POST legitimately carries more than a hundred traces; this
+      # used to keep the first hundred and answer 202 for the rest, which
+      # were silently gone. ProcessTelemetryTracesJob bounds its own work by
+      # slicing and re-enqueueing the remainder.
       def create
-        traces = Array(params[:traces]).take(MAX_TRACES_PER_REQUEST)
+        traces = Array(params[:traces])
         sdk_info = params[:sdk] || {}
 
         return head :accepted if traces.empty?
@@ -106,6 +110,22 @@ module ActionAgent
         render json: { error: "Invalid API key" }, status: :unauthorized
       end
 
+      # The host app's quota checker, asked with kind :trace_ingest — the
+      # counterpart to Api::BaseController#enforce_quota!, which asks with
+      # :execution. Denials are 429 here rather than 402: a reporter that is
+      # over its ingest allowance should back off, not upgrade mid-flush.
+      # Same body shape, so a checker's message or Hash payload reads the
+      # same on both.
+      def enforce_ingest_quota!
+        denial = ActionAgent.quota_denial(@account, :trace_ingest)
+        return if denial.blank?
+
+        body = { error: "Trace ingest limit reached" }
+        body = denial.is_a?(Hash) ? body.merge(denial) : body.merge(message: denial)
+
+        render json: body, status: :too_many_requests
+      end
+
       # Extracts Bearer token from Authorization header.
       def extract_bearer_token
         auth_header = request.headers["Authorization"]

data/app/controllers/action_agent/api/usage_controller.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  module Api
+    # The plan meter the Organization view and the Run Agents quota banner
+    # read. Both were extracted from the platform along with the route they
+    # fetch, but the engine never gained the route, so every visit to either
+    # view logged a 404.
+    #
+    # The engine meters nothing itself. A host that tracks usage against a
+    # plan answers through ActionAgent.usage_resolver; a bare mount reports
+    # unlimited, in the same shape, so the views can hide the meter.
+    class UsageController < BaseController
+      # GET /api/usage
+      def show
+        render json: { usage: ActionAgent.usage_for(current_owner) }
+      end
+    end
+  end
+end

data/app/controllers/action_agent/application_controller.rb

@@ -39,10 +39,33 @@ module ActionAgent
       end
 
       result = ActionAgent.authentication_method.call(self)
-      head :unauthorized unless result
+      deny_access unless result
     rescue StandardError => e
       Rails.logger.error("[ActionAgent] Authentication error: #{e.message}")
-      head :unauthorized
+      deny_access
+    end
+
+    # A browser asking for a page is sent to the host's sign-in page when one
+    # is configured, and otherwise shown a minimal session-expired page — a
+    # bare 401 with no body renders as a browser error screen. API and MCP
+    # clients get the bare 401 they expect.
+    def deny_access
+      return head :unauthorized unless Engine.html_request?(request)
+
+      if ActionAgent.sign_in_path.present?
+        redirect_to ActionAgent.sign_in_path, allow_other_host: false
+      else
+        render html: <<~HTML.html_safe, status: :unauthorized, layout: false
+          <!doctype html>
+          <html><head><meta charset="utf-8"><title>Sign in required</title></head>
+          <body style="font-family: -apple-system, 'Segoe UI', Roboto, sans-serif; display: grid; place-items: center; min-height: 100vh; margin: 0; color: #0f172a; background: #f8fafc;">
+          <div style="text-align: center;">
+            <h1 style="font-size: 20px;">Sign in required</h1>
+            <p style="color: #475569;">Your session has expired or you are not signed in.<br>Sign in to the host application, then reload this page.</p>
+          </div>
+          </body></html>
+        HTML
+      end
     end
 
     # Returns the current user from the host application.

data/app/controllers/action_agent/dashboard_controller.rb

@@ -43,8 +43,10 @@ module ActionAgent
         instructionSets: Agent::INSTRUCTION_SETS,
         availableTools: Agent::AVAILABLE_TOOLS,
         executionEnabled: ActionAgent.execution_enabled?,
+        assistantEnabled: ActionAgent.assistant_enabled?,
         multiTenant: ActionAgent.multi_tenant?,
-        upgradeUrl: ActionAgent.upgrade_url
+        upgradeUrl: ActionAgent.upgrade_url,
+        signOutPath: ActionAgent.sign_out_path
       }
     end
 

data/app/controllers/concerns/action_agent/api/agent_serialization.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  module Api
+    # The agent JSON the dashboard reads, shared by every endpoint that hands
+    # an agent to the React app.
+    #
+    # Two shapes: the summary the list renders, and the detail (instructions,
+    # tools, mcp_servers, model_config, ...) the editor initializes from. Any
+    # endpoint that returns an agent the client may go on to *edit* must
+    # render the detail shape: AgentEditor seeds its form from whatever it is
+    # given, and a summary seeds it with empty instructions/tools/config,
+    # which the first Save then persists over the real record.
+    module AgentSerialization
+      extend ActiveSupport::Concern
+
+      private
+
+      def agent_json(agent, include_details: false)
+        json = {
+          id: agent.id,
+          name: agent.name,
+          slug: agent.slug,
+          description: agent.description,
+          provider: agent.provider,
+          model: agent.model,
+          status: agent.status,
+          preset_type: agent.preset_type,
+          appearance: agent.appearance,
+          version_count: agent.version_count,
+          created_at: agent.created_at,
+          updated_at: agent.updated_at
+        }
+
+        if include_details
+          json.merge!(
+            instructions: agent.instructions,
+            action_prompts: agent.action_prompts,
+            instruction_sets: agent.instruction_sets,
+            tools: agent.tools,
+            mcp_servers: agent.mcp_servers,
+            model_config: agent.model_config,
+            response_format: agent.response_format,
+            agent_class_name: agent.agent_class_name,
+            telemetry_agent_class: agent.telemetry_agent_class
+          )
+        end
+
+        json
+      end
+    end
+  end
+end

data/app/jobs/action_agent/agent_execution_job.rb

@@ -6,7 +6,9 @@ module ActionAgent
 
     def perform(run_id)
       run = AgentRun.find(run_id)
-      return if run.cancelled? || run.complete?
+      # Anything already finished — complete, failed or cancelled — is never
+      # executed again. A retry of a failed run would re-run the generation.
+      return if run.finished?
 
       run.update!(status: :running, started_at: Time.current)
       run.add_log("Starting execution", level: :info)
@@ -17,26 +19,29 @@ module ActionAgent
         # Build the agent class dynamically based on configuration
         result = execute_agent(agent_record, run)
 
-        run.update!(
-          output: result[:output],
-          output_metadata: result[:metadata],
-          status: :complete,
-          completed_at: Time.current,
-          duration_ms: ((Time.current - run.started_at) * 1000).to_i,
-          input_tokens: result.dig(:usage, :input_tokens),
-          output_tokens: result.dig(:usage, :output_tokens),
-          total_tokens: result.dig(:usage, :total_tokens)
-        )
-        run.add_log("Execution completed successfully", level: :info)
-
+        finish_unless_cancelled(run) do
+          run.update!(
+            output: result[:output],
+            output_metadata: result[:metadata],
+            status: :complete,
+            completed_at: Time.current,
+            duration_ms: ((Time.current - run.started_at) * 1000).to_i,
+            input_tokens: result.dig(:usage, :input_tokens),
+            output_tokens: result.dig(:usage, :output_tokens),
+            total_tokens: result.dig(:usage, :total_tokens)
+          )
+          run.add_log("Execution completed successfully", level: :info)
+        end
       rescue => e
-        run.update!(
-          status: :failed,
-          completed_at: Time.current,
-          error_message: e.message,
-          error_backtrace: e.backtrace&.first(10)&.join("\n")
-        )
-        run.add_log("Execution failed: #{e.message}", level: :error)
+        finish_unless_cancelled(run) do
+          run.update!(
+            status: :failed,
+            completed_at: Time.current,
+            error_message: e.message,
+            error_backtrace: e.backtrace&.first(10)&.join("\n")
+          )
+          run.add_log("Execution failed: #{e.message}", level: :error)
+        end
         raise
       ensure
         run.broadcast_update
@@ -48,5 +53,20 @@ module ActionAgent
     def execute_agent(agent_record, run)
       AgentExecutionService.call(agent_record, run)
     end
+
+    # A cancel that arrived while the service was running must survive it:
+    # the run's terminal state is written under a row lock after re-reading
+    # the status, so a cancelled run is never flipped back to complete or
+    # failed by the job that was still executing it.
+    def finish_unless_cancelled(run)
+      run.with_lock do
+        if run.cancelled?
+          run.add_log("Execution finished after cancellation; result discarded", level: :info)
+          return
+        end
+
+        yield
+      end
+    end
   end
 end

data/app/jobs/action_agent/application_job.rb

@@ -2,10 +2,14 @@
 
 module ActionAgent
   # Base class for all Dashboard engine jobs.
+  #
+  # No blanket retry_on: the engine's jobs are not idempotent. An agent run
+  # that fails after real provider work would be re-executed (and re-billed)
+  # on every retry, flipping the run's status failed -> running -> failed
+  # and overwriting its timings, after the UI had already stopped polling on
+  # the first failure. Jobs that can safely retry declare it themselves, for
+  # the specific transient errors they can tolerate.
   class ApplicationJob < ActiveJob::Base
-    # Retry failed jobs
-    retry_on StandardError, wait: :polynomially_longer, attempts: 3
-
     # Discard jobs for records that no longer exist
     discard_on ActiveRecord::RecordNotFound
   end

data/app/jobs/action_agent/evaluation_run_job.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  # Executes an evaluation run created by Evaluation#run_later!. The run
+  # record already exists (pending), so the dashboard can show it while the
+  # job is queued; the runner marks it running, then complete or failed.
+  class EvaluationRunJob < ApplicationJob
+    queue_as :agents
+
+    def perform(evaluation_id, run_id, selection = {})
+      evaluation = Evaluation.find(evaluation_id)
+      run = evaluation.evaluation_runs.find(run_id)
+      return unless run.pending?
+
+      evaluation.run!(run: run, **selection.to_h.symbolize_keys)
+    end
+  end
+end

data/app/jobs/action_agent/sandbox_cleanup_job.rb

@@ -4,16 +4,16 @@ module ActionAgent
   class SandboxCleanupJob < ApplicationJob
     queue_as :sandboxes
 
-    # Clean up Cloud Run resources for an expired sandbox
+    # Release the infrastructure behind an expired sandbox.
     def perform(sandbox_session_id)
       sandbox = SandboxSession.find_by(id: sandbox_session_id)
       return unless sandbox
 
       Rails.logger.info("Cleaning up sandbox: #{sandbox.session_id}")
 
-      # Delete Cloud Run Job if exists
+      # Terminate the backend resource if one was provisioned
       if sandbox.cloud_run_job_id.present? && !Rails.env.development?
-        delete_cloud_run_job(sandbox.cloud_run_job_id)
+        terminate_backend_sandbox(sandbox.cloud_run_job_id)
       end
 
       # Optionally delete old sandbox records
@@ -30,13 +30,16 @@ module ActionAgent
 
     private
 
-    def delete_cloud_run_job(job_id)
-      require "google/cloud/run/v2"
-
-      client = Google::Cloud::Run::V2::Jobs::Client.new
-      client.delete_job(name: job_id)
-    rescue => e
-      Rails.logger.warn("Failed to delete Cloud Run job #{job_id}: #{e.message}")
+    # Through the orchestrator, like provisioning: whichever backend the
+    # host registered (Incus, Kubernetes, Cloud Run, or the built-in mock)
+    # reclaims its own resource. This used to require google/cloud/run/v2
+    # directly, which the engine does not depend on — a LoadError is a
+    # ScriptError, not a StandardError, so it escaped the rescue and the job
+    # failed on every host but the one that happened to bundle the SDK.
+    def terminate_backend_sandbox(sandbox_id)
+      SandboxOrchestrator.new.terminate(sandbox_id)
+    rescue StandardError => e
+      Rails.logger.warn("Failed to terminate sandbox #{sandbox_id}: #{e.message}")
     end
   end
 end