actionagent 1.5.2 → 1.6.2

data/app/services/action_agent/evaluation_runner_service.rb

@@ -468,15 +468,17 @@ module ActionAgent
     end
 
     def judge_class
-      provider = judge_provider
-      model = @evaluation.judge_model.presence
-      options = {}
-      options[:model] = model if model
-      options.merge!(owner_provider_options(provider))
-
-      @judge_class ||= Class.new(ActiveAgent::Base) do
-        define_singleton_method(:name) { "EvaluationJudgeAgent" }
-        generate_with provider, **options
+      @judge_class ||= begin
+        provider = judge_provider
+        model = @evaluation.judge_model.presence
+        options = {}
+        options[:model] = model if model
+        options.merge!(owner_provider_options(provider))
+
+        Class.new(ActiveAgent::Base) do
+          define_singleton_method(:name) { "EvaluationJudgeAgent" }
+          generate_with provider, **options
+        end
       end
     end
 

data/app/services/action_agent/scenario_evaluation_runner.rb

@@ -147,7 +147,8 @@ module ActionAgent
       agent_run = @evaluation.agent.test_execute(
         scenario.prompt,
         model_override: spec.model,
-        provider_override: spec.provider
+        provider_override: spec.provider,
+        actor: replay_actor
       )
 
       Evals::Replay.new(
@@ -162,6 +163,21 @@ module ActionAgent
       )
     end
 
+    # The caller a replay runs on behalf of: the evaluation's owner, when the
+    # install owns agents per user. A run with no caller reads, through any
+    # host scope, as "no access" — every tool answers empty and the suite
+    # grades an agent that never saw a row — so the person the evaluation
+    # belongs to is the right default, as the key's owner is over MCP. An
+    # account is who is billed, not who is allowed (see Api::BaseController
+    # #agent_actor), so a multi-tenant install replays unattributed unless a
+    # host adapter (ActionAgent.scenario_evaluation_adapter_resolver) runs
+    # the suite itself.
+    def replay_actor
+      return nil if ActionAgent.multi_tenant? || ActionAgent.user_class.blank?
+
+      owner
+    end
+
     # Each tool call the run made, rebuilt from the run's progress events
     # (AgentRun#append_event pairs a "started" event with its "done"/"error"
     # by eid). Falls back to the bare names in the run's metadata for a run

data/config/routes.rb

@@ -38,6 +38,9 @@ ActionAgent::Engine.routes.draw do
         post :duplicate
         get :export
         get :analytics
+        # The Tools tab's roster: offerable tools and MCP services, each
+        # with what the window recorded for it.
+        get :tool_roster
         # The runner's conversation picker: this agent's persisted contexts,
         # and a fresh one to pin a first message to.
         get :conversations
@@ -158,6 +161,9 @@ ActionAgent::Engine.routes.draw do
   # dashboard API key rather than a session, so it sits outside the api
   # namespace's session-authenticated controllers.
   post "mcp", to: "api/mcp#create"
+  match "mcp", to: ->(_env) { [ 405, { "Allow" => "POST" }, [] ] },
+    via: [ :get, :delete ],
+    constraints: ->(request) { request.delete? || !request.format.html? }
 
   # MCP Streamable HTTP (2025-03-26): a client MAY open the server-to-client
   # SSE stream with GET, and ends a session with DELETE. This facade offers

data/lib/action_agent/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ActionAgent
-  VERSION = "1.5.2"
+  VERSION = "1.6.2"
 end

data/lib/action_agent.rb

@@ -145,6 +145,26 @@ module ActionAgent
     # @return [Proc, nil]
     attr_accessor :current_user_resolver
 
+    # Resolves the caller an agent run executes on behalf of — what reaches
+    # +ActiveAgent::Base#current_user+, a SchemaTools +scope+ block, and any
+    # authorization gem an agent calls from its callbacks.
+    #
+    # Called with the controller, so the same seam covers a browser session
+    # and an MCP request. Whatever it returns is passed through untouched:
+    # the engine never interprets an actor, and never widens one.
+    #
+    #   config.agent_actor_resolver = ->(controller) { controller.current_user }
+    #
+    # Unset means the dashboard's signed-in user, and, for the MCP endpoint,
+    # the API key's owner — the identity that authenticated the call. A host
+    # whose keys are issued per end user overrides this to return that user.
+    #
+    # Returning nil runs the agent unattributed, which a correctly written
+    # host scope reads as "no access". That is the safe direction, and it is
+    # why this is never defaulted to something more privileged.
+    # @return [Proc, nil]
+    attr_accessor :agent_actor_resolver
+
     # Resolves the current tenant from the controller. See
     # current_user_resolver.
     # @return [Proc, nil]
@@ -348,9 +368,21 @@ module ActionAgent
     # @return [Array<Class, String>, nil]
     attr_accessor :schema_tools
 
+    # Whether the MCP facade (POST <mount>/mcp) offers the host's schema tools
+    # directly — find_<records>, count_<records>, get_<record> — beside the
+    # run_<slug> agent tools. Each call runs as the key's caller, through the
+    # host's own scope, exactly as it would inside an agent run. On by
+    # default: the host declared the tools; set it to false to keep them
+    # reachable only through agents.
+    # @return [Boolean]
+    attr_accessor :mcp_schema_tools
+
     # Directory scanned for SchemaTools subclasses when {#schema_tools} is
     # unset. Relative to the host's root. Set to nil to disable discovery and
-    # require an explicit declaration.
+    # require an explicit declaration. Classes built at runtime with
+    # +ActiveAgent::SchemaTools.define+ are discovered alongside the files
+    # whatever this is set to; only an explicit {#schema_tools} list excludes
+    # them.
     # @return [String, nil]
     attr_accessor :schema_tools_path
 
@@ -368,6 +400,13 @@ module ActionAgent
       @multi_tenant == true
     end
 
+    # Whether the MCP facade serves the host's schema tools directly.
+    #
+    # @return [Boolean]
+    def mcp_schema_tools?
+      @mcp_schema_tools != false
+    end
+
     # Returns whether agent execution is permitted.
     #
     # @return [Boolean]
@@ -519,8 +558,10 @@ module ActionAgent
       @sign_out_path = nil
       @sign_in_path = nil
       @mcp_catalog = []
+      @agent_actor_resolver = nil
       @schema_tools = nil
       @schema_tools_path = "app/agent_tools"
+      @mcp_schema_tools = nil
     end
 
     # Host-declared schema tool classes, resolved from names and filtered to
@@ -550,14 +591,31 @@ module ActionAgent
       schema_tool_classes.flat_map(&:tool_names).map(&:to_s)
     end
 
-    # SchemaTools subclasses defined under {#schema_tools_path}.
+    # SchemaTools classes on offer when {#schema_tools} is unset: the files
+    # under {#schema_tools_path}, and every runtime definition in
+    # +ActiveAgent::SchemaTools.registry+.
     #
     # The files are loaded before reading +descendants+: in development nothing
     # has referenced those constants yet, so the list would otherwise be empty
     # at boot and fill in only once something happened to touch them.
+    # Runtime-built classes are read from the registry, never from
+    # +descendants+, where every class ever built stays until collected and a
+    # superseded definition would be offered beside its replacement. A runtime
+    # definition for a model also supersedes a file for that model: it is the
+    # more recent intent.
     # @return [Array<Class>]
     def discovered_schema_tools
-      return [] if @schema_tools_path.blank? || !defined?(ActiveAgent::SchemaTools)
+      return [] unless defined?(ActiveAgent::SchemaTools)
+
+      from_registry = ActiveAgent::SchemaTools.respond_to?(:registry) ? ActiveAgent::SchemaTools.registry.values : []
+      (from_registry + file_defined_schema_tools).uniq { |klass| klass.model.name }
+    end
+
+    # The named SchemaTools subclasses under {#schema_tools_path}; none when
+    # the path is unset or the directory does not exist.
+    # @return [Array<Class>]
+    def file_defined_schema_tools
+      return [] if @schema_tools_path.blank?
       return [] unless defined?(Rails) && Rails.respond_to?(:root) && Rails.root
 
       root = Rails.root.join(@schema_tools_path)
@@ -569,7 +627,11 @@ module ActionAgent
         warn "[ActionAgent] could not load #{path}: #{e.class} - #{e.message}"
       end
 
-      ActiveAgent::SchemaTools.descendants.select { |klass| klass.name.present? }
+      ActiveAgent::SchemaTools.descendants.select { |klass| klass.name.present? && !runtime_schema_tools?(klass) }
+    end
+
+    def runtime_schema_tools?(klass)
+      klass.respond_to?(:runtime?) && klass.runtime?
     end
 
     # The schema tool class that generated +name+, or nil.

data/lib/generators/action_agent/install_generator.rb

@@ -57,6 +57,12 @@ module ActionAgent
         )
       end
 
+      # Agent releases arrived after both tables shipped; the migration guards
+      # every column, so it is emitted for any install that lacks it.
+      unless existing_migration?("add_agent_releases")
+        migration_template("add_agent_releases.rb.erb", "db/migrate/add_agent_releases.rb")
+      end
+
       # The rest of the dashboard — agents, runs, versions, conversations,
       # evaluations, sandboxes, recordings, keys. Skippable for an app that
       # only wants to be a trace sink.

data/lib/generators/action_agent/templates/action_agent.rb.erb

@@ -31,6 +31,14 @@ ActionAgent.configure do |config|
   #   config.authentication_method = nil
   #
   config.authentication_method = nil
+  #
+  # Where a browser is sent when it asks for a dashboard page without a valid
+  # session; unset, it gets a minimal session-expired page. API clients get a
+  # bare 401 either way. The sign-out path is what the header's "Sign out"
+  # item POSTs to (with _method=delete); unset, the item is not shown.
+  #
+  # config.sign_in_path = "/sign_in"
+  # config.sign_out_path = "/sign_out"
 
   # ==========================================================================
   # Ingest API authentication

data/lib/generators/action_agent/templates/add_agent_releases.rb.erb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+# Agent releases: a version cut from the agent's code carries the digest of
+# what the model was given and the deploy it shipped in, and every trace,
+# run and evaluation run records the version it ran under. Emitted for an
+# install whose dashboard tables predate releases; the create-table
+# migration carries the same columns for a fresh install.
+#
+# Each step is guarded so the migration is safe to re-run against a database
+# that already has some of these columns.
+class AddAgentReleases < ActiveRecord::Migration<%= migration_version %>
+  def up
+    add_column_unless_exists :active_agent_agents, :release_digest, :string
+
+    add_column_unless_exists :active_agent_agent_versions, :release_digest, :string
+    add_column_unless_exists :active_agent_agent_versions, :revision, :string
+    add_index_unless_exists :active_agent_agent_versions, [ :agent_id, :release_digest ]
+
+    %i[active_agent_telemetry_traces active_agent_agent_runs active_agent_evaluation_runs].each do |table|
+      add_column_unless_exists table, :agent_version_id, :bigint
+      add_index_unless_exists table, :agent_version_id
+    end
+  end
+
+  def down
+    remove_column :active_agent_agents, :release_digest if column_exists?(:active_agent_agents, :release_digest)
+    remove_column :active_agent_agent_versions, :release_digest if column_exists?(:active_agent_agent_versions, :release_digest)
+    remove_column :active_agent_agent_versions, :revision if column_exists?(:active_agent_agent_versions, :revision)
+
+    %i[active_agent_telemetry_traces active_agent_agent_runs active_agent_evaluation_runs].each do |table|
+      remove_column table, :agent_version_id if column_exists?(table, :agent_version_id)
+    end
+  end
+
+  private
+
+  def add_column_unless_exists(table, column, type)
+    return unless table_exists?(table)
+    return if column_exists?(table, column)
+
+    add_column table, column, type
+  end
+
+  def add_index_unless_exists(table, columns)
+    return unless table_exists?(table)
+    return if index_exists?(table, columns)
+
+    add_index table, columns
+  end
+end

data/lib/tasks/action_agent.rake

@@ -7,3 +7,36 @@ namespace :action_agent do
     puts "Agent template library: #{ActionAgent::AgentTemplate.count} templates"
   end
 end
+
+namespace :action_agent do
+  namespace :agents do
+    desc "Cut a dashboard version for every agent whose code changed (run on deploy; REVISION=<git sha> to label it)"
+    task :release, [ :revision ] => :environment do |_task, args|
+      Rails.application.eager_load!
+      result = ActionAgent::AgentRelease.call(revision: args[:revision] || ENV["REVISION"], released_by: ENV["RELEASED_BY"])
+
+      puts "Release #{result.revision.presence || '(no revision)'}"
+      result.rows.each do |row|
+        if row.skipped
+          puts format("  %-28s skipped — %s", row.agent.name, row.skipped)
+        elsif row.cut
+          puts format("  %-28s v%-3d cut   %s", row.agent.name, row.version.version_number, row.version.change_summary)
+        else
+          puts format("  %-28s v%-3d unchanged (%s)", row.agent.name, row.version.version_number, row.version.release_digest)
+        end
+      end
+      puts "#{result.cut.size} cut, #{result.rows.size - result.cut.size - result.skipped.size} unchanged, #{result.skipped.size} skipped"
+    end
+
+    desc "List each agent's current version and release"
+    task versions: :environment do
+      ActionAgent::Agent.order(:name).find_each do |agent|
+        version = agent.latest_version
+        release = agent.latest_release
+        puts format("%-28s v%-3s %s%s", agent.name, version&.version_number || "-",
+                    release ? "release #{release.release_digest}" : "no release",
+                    release&.revision.present? ? " · #{release.revision}" : "")
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionagent
 version: !ruby/object:Gem::Version
-  version: 1.5.2
+  version: 1.6.2
 platform: ruby
 authors:
 - Justin Bowen
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-11 00:00:00.000000000 Z
+date: 2026-09-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activeagent
@@ -193,7 +193,9 @@ files:
 - app/serializers/action_agent/trace_interaction_serializer.rb
 - app/services/action_agent/agent_execution_service.rb
 - app/services/action_agent/agent_registrar.rb
+- app/services/action_agent/agent_release.rb
 - app/services/action_agent/agent_scorecard.rb
+- app/services/action_agent/agent_tool_roster.rb
 - app/services/action_agent/agent_toolbox.rb
 - app/services/action_agent/dashboard_assistant_service.rb
 - app/services/action_agent/evaluation_evidence.rb
@@ -226,6 +228,7 @@ files:
 - lib/generators/action_agent/install_generator.rb
 - lib/generators/action_agent/templates/action_agent.rb.erb
 - lib/generators/action_agent/templates/add_agent_id_to_active_agent_telemetry_traces.rb.erb
+- lib/generators/action_agent/templates/add_agent_releases.rb.erb
 - lib/generators/action_agent/templates/create_active_agent_dashboard_tables.rb.erb
 - lib/generators/action_agent/templates/create_active_agent_evaluation_scenarios.rb.erb
 - lib/generators/action_agent/templates/create_active_agent_telemetry_traces.rb.erb