actionagent 1.7.2 → 1.8.0

data/app/services/action_agent/sandbox_manifest.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  # The runtime manifest: how a booted checkout tells the sandbox backend
+  # where its MCP facade answers and which bearer token opens it.
+  #
+  #   { "mcp_path": "/activeagents/mcp", "mcp_token": "aa_..." }
+  #
+  # The checked-out app writes it with `bin/rails action_agent:sandbox:manifest`
+  # (it mounts this engine, so the task ships with it), and a backend reads it
+  # back with .parse. Both halves live here so they cannot drift.
+  module SandboxManifest
+    # Where the manifest task writes, when set; stdout otherwise.
+    PATH_ENV = "ACTION_AGENT_SANDBOX_MANIFEST"
+    # The dashboard API key the manifest hands out, created once per checkout.
+    KEY_NAME = "Checkout sandbox runtime"
+
+    class Error < StandardError; end
+
+    module_function
+
+    # Builds the manifest inside the booted app: the engine's MCP path under
+    # wherever the app mounts it, and an API key for the MCP facade.
+    #
+    # @param routes [ActionDispatch::Routing::RouteSet] the app's routes
+    # @return [Hash{String => String}]
+    def generate(routes: Rails.application.routes)
+      # Rails 8 loads routes lazily in development and test; the mount is
+      # invisible until they are.
+      Rails.application.reload_routes_unless_loaded if Rails.application.respond_to?(:reload_routes_unless_loaded)
+
+      mount = ActiveAgent::Telemetry::Configuration.new.mount_path_in(routes)
+      raise Error, "ActionAgent::Engine is not mounted in this app's routes" if mount.nil?
+
+      { "mcp_path" => "#{mount}/mcp", "mcp_token" => api_key.token }
+    end
+
+    # The checkout's own dashboard API key for the facade. Reused across
+    # runs so a re-run manifest does not mint a key per boot. A host that
+    # owns keys by account or user gets a key with no owner, which reaches
+    # no agents over MCP — the manifest says so rather than failing.
+    def api_key
+      ActionAgent::ApiKey.find_or_create_by!(name: KEY_NAME)
+    end
+
+    # Reads a manifest a checkout wrote.
+    #
+    # @param json [String]
+    # @return [Hash{String => String}] with "mcp_path" and "mcp_token"
+    def parse(json)
+      data = JSON.parse(json.to_s)
+      raise Error, "the manifest is not a JSON object" unless data.is_a?(Hash)
+
+      path = data["mcp_path"]
+      unless path.is_a?(String) && path.start_with?("/")
+        raise Error, "the manifest names no mcp_path (expected a path such as /activeagents/mcp)"
+      end
+
+      token = data["mcp_token"]
+      raise Error, "the manifest's mcp_token is not a string" unless token.nil? || token.is_a?(String)
+
+      { "mcp_path" => path, "mcp_token" => token }
+    rescue JSON::ParserError => e
+      raise Error, "the manifest is not JSON (#{e.message.truncate(120)})"
+    end
+  end
+end

data/app/services/action_agent/sandbox_orchestrator.rb

@@ -3,16 +3,14 @@
 module ActionAgent
   # SandboxOrchestrator
   #
-  # Unified interface for managing agent sandbox sessions.
-  # Supports multiple backends for cloud-agnostic deployment:
-  #
-  #   - incus:     Self-hosted Incus containers (any Linux host)
-  #   - cloud_run: Google Cloud Run Jobs (serverless)
-  #   - kubernetes: Kubernetes pods (GKE, EKS, self-hosted k8s)
+  # Unified interface for managing agent sandbox sessions. The engine ships
+  # two backends — :mock (in-memory, runs nothing) and :local (checkouts as
+  # child processes of the dashboard) — and a host registers the rest
+  # (Incus, Cloud Run, Kubernetes) in ActionAgent.sandbox_backends.
   #
   # Configuration:
-  #   Set SANDBOX_BACKEND environment variable to choose backend.
-  #   Default: "incus" for simplicity
+  #   ActionAgent.sandbox_service, or the SANDBOX_BACKEND environment
+  #   variable, which wins. Default: :mock.
   #
   # Usage:
   #   orchestrator = SandboxOrchestrator.new
@@ -21,14 +19,21 @@ module ActionAgent
   #   orchestrator.terminate(container_id)
   #
   class SandboxOrchestrator
-    # The engine ships only the in-memory backend. Anything that talks to
-    # real infrastructure (Incus, Kubernetes, Cloud Run) is registered by
-    # the app that operates it, so the engine carries none of those SDKs:
+    # Anything that talks to real infrastructure (Incus, Kubernetes, Cloud
+    # Run) is registered by the app that operates it, so the engine carries
+    # none of those SDKs:
     #
     #   ActionAgent.sandbox_backends = {
     #     "cloud_run" => "CloudRunService"
     #   }
-    BUILT_IN_BACKENDS = { "mock" => "ActionAgent::MockSandboxBackend" }.freeze
+    #
+    # The engine also ships :local, which boots app_runtime checkouts as
+    # child processes of the dashboard itself (see LocalSandboxBackend and
+    # ActionAgent.local_sandboxes_enabled?).
+    BUILT_IN_BACKENDS = {
+      "mock" => "ActionAgent::MockSandboxBackend",
+      "local" => "ActionAgent::LocalSandboxBackend"
+    }.freeze
 
     # Backends disagree on what to call each verb. Candidates are tried in
     # order and the first the backend responds to wins, so a host-registered
@@ -38,7 +43,11 @@ module ActionAgent
       status: %i[status container_status pod_status job_status],
       terminate: %i[terminate terminate_pod cancel_job],
       list: %i[list_sandboxes list_sandbox_pods list_jobs],
-      cleanup: %i[cleanup_expired cleanup_expired_pods cleanup_expired_jobs]
+      cleanup: %i[cleanup_expired cleanup_expired_pods cleanup_expired_jobs],
+      # Claude Code sessions inside an app_runtime checkout. Optional: a
+      # backend without them simply cannot run sessions (see #supports?).
+      code_session: %i[run_code_session],
+      cancel_code_session: %i[cancel_code_session]
     }.freeze
 
     class UnsupportedBackendError < StandardError; end
@@ -101,7 +110,12 @@ module ActionAgent
         instance_tier: result[:instance_tier] || tier&.id,
         resources: result[:resources],
         hourly_cost: result[:hourly_cost] || tier&.hourly_cost&.to_f,
-        created_at: result[:created_at] || Time.current
+        created_at: result[:created_at] || Time.current,
+        # An app_runtime sandbox's backend clones sandbox_session.checkout_spec,
+        # boots the app, and reports where its MCP facade answers (and the
+        # bearer token it expects) so agents can use the checkout's tools.
+        mcp_url: result[:mcp_url],
+        mcp_token: result[:mcp_token]
       }
     end
 
@@ -153,6 +167,47 @@ module ActionAgent
       @backend.public_send(adapter_method(:cleanup))
     end
 
+    # The handle the backend would give +sandbox_session+'s sandbox, for a
+    # backend that derives it from the session (nil otherwise).
+    def handle_for(sandbox_session)
+      @backend.respond_to?(:handle_for) ? @backend.handle_for(sandbox_session) : nil
+    end
+
+    # Whether the backend can name a session's sandbox without a recorded
+    # handle (see #handle_for).
+    def derives_handles?
+      @backend.respond_to?(:handle_for)
+    end
+
+    # Whether the backend runs sandboxes as processes of the dashboard, on
+    # its own machine and as its own user (LocalSandboxBackend): the only
+    # place ActionAgent.claude_code_auth = :local_login can work.
+    def local?
+      @backend.is_a?(LocalSandboxBackend)
+    end
+
+    # Whether the backend implements +verb+ (an ADAPTER_METHODS key).
+    def supports?(verb)
+      ADAPTER_METHODS.fetch(verb).any? { |m| @backend.respond_to?(m) }
+    end
+
+    # Runs a Claude Code session in +sandbox_session+'s checkout, yielding
+    # each stream-json event (a Hash) as it arrives. Returns the backend's
+    # outcome: { exit_status:, diff: }.
+    def run_code_session(sandbox_session, code_session, &on_event)
+      # Checked when a session is requested too; this covers one queued
+      # before the configuration changed.
+      refusal = ClaudeCodeAuth.backend_refusal(self)
+      raise UnsupportedBackendError, refusal if refusal
+
+      @backend.public_send(adapter_method(:code_session), sandbox_session, code_session, &on_event)
+    end
+
+    # Stops a running Claude Code session.
+    def cancel_code_session(sandbox_session, code_session)
+      @backend.public_send(adapter_method(:cancel_code_session), sandbox_session, code_session)
+    end
+
     # Check if the backend is healthy
     #
     # @return [Boolean] true if backend is reachable

data/app/services/action_agent/scenario_evaluation_runner.rb

@@ -17,7 +17,16 @@ module ActionAgent
   #   "_models"          — per model: pass rate, mean score, latency, tokens, cost, fault counts
   #   "_recommendations" — faults grouped across scenarios with the fix each calls for
   #   "_verdict"         — the best model and why (judge-written when a judge is available)
-  #   "_selection"       — the scenarios and models this run covered
+  #   "_selection"       — the scenarios and models this run covered, and
+  #                        the checkout sandbox it replayed against, if any
+  #
+  # A selection's `sandbox_id` names a checkout sandbox whose app runtime
+  # every replay reaches beside the agent's own MCP servers, as if the agent
+  # listed it (see Api::RunSandbox, which checked the caller owns it). The
+  # agent is not changed. The runtime is resolved again here, among the
+  # agent's owner's sessions, since the run may start well after it was
+  # asked for; one that is no longer live fails the run rather than
+  # replaying without the tools it was meant to test.
   class ScenarioEvaluationRunner < EvaluationRunnerService
     Evals = ActiveAgent::Evals
 
@@ -43,6 +52,7 @@ module ActionAgent
       specs = model_specs
       run = @run || @evaluation.evaluation_runs.create!(status: :pending)
       run.update!(status: :running, selection: selection_summary(scenarios, specs))
+      ensure_sandbox_live!
 
       if scenarios.empty?
         run.update!(status: :failed, error_message: "No scenarios selected — add scenarios to the evaluation or widen the selection",
@@ -151,10 +161,45 @@ module ActionAgent
         "scenario_ids" => scenarios.map(&:id),
         "scenario_keys" => scenarios.map(&:key),
         "group" => @selection[:group].presence,
-        "models" => specs.map(&:to_h)
+        "models" => specs.map(&:to_h),
+        "sandbox" => sandbox_summary
       }.compact
     end
 
+    # --- sandbox ----------------------------------------------------------
+
+    # "sandbox:<session_id>" for a run against a checkout sandbox, or nil.
+    def sandbox_server_key
+      id = @selection[:sandbox_id]
+      "#{SandboxSession::RUNTIME_SERVER_PREFIX}#{id}" if id.is_a?(String) && id.present?
+    end
+
+    def sandbox_session
+      return @sandbox_session if defined?(@sandbox_session)
+
+      @sandbox_session = sandbox_server_key && SandboxSession.for_owner(owner).find_by(session_id: @selection[:sandbox_id])
+    end
+
+    # What the run records about its sandbox: which checkout, never its
+    # token.
+    def sandbox_summary
+      return nil unless sandbox_server_key
+
+      {
+        "session_id" => @selection[:sandbox_id],
+        "server_key" => sandbox_server_key,
+        "repository" => sandbox_session&.repository,
+        "repository_ref" => sandbox_session&.repository_ref
+      }.compact
+    end
+
+    def ensure_sandbox_live!
+      return unless sandbox_server_key
+      return if SandboxSession.runtime_server_entry(sandbox_server_key, owner: owner)
+
+      raise ArgumentError, "Sandbox #{@selection[:sandbox_id]} is no longer running; start it again, or run without it"
+    end
+
     # --- replay -----------------------------------------------------------
 
     def replay(scenario, spec)
@@ -167,7 +212,8 @@ module ActionAgent
         scenario.prompt,
         model_override: spec.model,
         provider_override: spec.provider,
-        actor: replay_actor
+        actor: replay_actor,
+        runtime_sandbox: sandbox_server_key
       )
 
       Evals::Replay.new(
@@ -303,7 +349,7 @@ module ActionAgent
     end
 
     def mcp_dispatcher
-      @mcp_dispatcher ||= MCPToolDispatcher.new(@evaluation.agent)
+      @mcp_dispatcher ||= MCPToolDispatcher.new(@evaluation.agent, extra_server_keys: [ sandbox_server_key ].compact)
     end
 
     # A run whose every declared MCP server failed discovery scored an agent

data/app/services/action_agent/secret_scrubber.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  # Replaces known secrets in text or nested JSON-like data before it is
+  # stored or shown: a sandbox's GitHub token and Claude Code credential can
+  # surface in a process's output (an error echoing a URL, a session that
+  # prints its environment), and none of that may reach a transcript, a log
+  # tail or an API response.
+  module SecretScrubber
+    MASK = "[REDACTED]"
+    # Shorter values are not credentials, and masking them would mangle text.
+    MIN_SECRET_LENGTH = 8
+
+    module_function
+
+    # @param value [String, Hash, Array, Object] what to scrub
+    # @param secrets [Array<String>] the values to mask
+    # @return a copy of +value+ with every secret masked
+    def scrub(value, secrets)
+      secrets = Array(secrets).compact.map(&:to_s).select { |secret| secret.length >= MIN_SECRET_LENGTH }.uniq
+      return value if secrets.empty?
+
+      # Longest first, so a secret that contains another is masked whole.
+      pattern = Regexp.union(secrets.sort_by { |secret| -secret.length })
+      deep_scrub(value, pattern)
+    end
+
+    def deep_scrub(value, pattern)
+      case value
+      when String then value.gsub(pattern, MASK)
+      when Hash then value.to_h { |key, item| [ key, deep_scrub(item, pattern) ] }
+      when Array then value.map { |item| deep_scrub(item, pattern) }
+      else value
+      end
+    end
+  end
+end

data/app/services/action_agent/tool_discovery.rb

@@ -35,6 +35,9 @@ module ActionAgent
   #
   # Scopes are passed in rather than derived, so the caller's ownership
   # rules (single-user, per-user, or multi-tenant) decide what is visible.
+  # The same goes for checkout sandbox runtimes: the caller hands in the live
+  # ones it may see (SandboxSession.runtime_server_listings), and they are
+  # listed beside the catalog under their "sandbox:<session_id>" keys.
   class ToolDiscovery
     DEFAULT_WINDOW_HOURS = 24 * 7
     MAX_WINDOW_HOURS = 24 * 90
@@ -53,16 +56,20 @@ module ActionAgent
     ORIGIN_BUILTIN = "builtin"
     ORIGIN_AGENT = "agent"
 
-    attr_reader :traces, :agents, :window_hours, :since
+    attr_reader :traces, :agents, :window_hours, :since, :runtimes
 
     # @param traces [ActiveRecord::Relation] the traces the caller may read
     # @param agents [ActiveRecord::Relation] the agents the caller may reach
     # @param hours [Integer] how far back to look
-    def initialize(traces:, agents:, hours: DEFAULT_WINDOW_HOURS)
+    # @param runtimes [Array<Hash>] the live checkout sandbox runtimes the
+    #   caller may see, as SandboxSession.runtime_server_listings returns
+    #   them — token-free catalog-shaped entries
+    def initialize(traces:, agents:, hours: DEFAULT_WINDOW_HOURS, runtimes: [])
       @traces = traces
       @agents = agents
       @window_hours = hours.to_i.clamp(1, MAX_WINDOW_HOURS)
       @since = @window_hours.hours.ago
+      @runtimes = Array(runtimes).index_by { |runtime| runtime[:key] }
     end
 
     # The full inventory: every tool seen in the window, plus the MCP servers
@@ -500,7 +507,7 @@ module ActionAgent
         end
       end
 
-      keys = (MCPCatalog.keys + detected.keys + configured_servers.keys).uniq
+      keys = (MCPCatalog.keys + runtimes.keys + detected.keys + configured_servers.keys).uniq
 
       # detected has a default block that would materialize a bucket on
       # lookup, so unseen servers are passed through as an explicit nil.
@@ -509,7 +516,11 @@ module ActionAgent
     end
 
     def server_row(key, bucket)
-      catalog = MCPCatalog.find(key)
+      # A live checkout runtime reads like a catalog entry: known, named after
+      # its repository and ref, with the endpoint it serves on. Its listing
+      # carries no bearer token, so nothing below can render one.
+      catalog = MCPCatalog.find(key) || runtimes[key]
+      runtime = SandboxSession.runtime_server_key?(key)
       configured = configured_servers[key].to_a.sort
       calls = bucket ? bucket[:calls] : 0
 
@@ -524,11 +535,14 @@ module ActionAgent
         docs_url: catalog&.fetch(:docs_url, nil),
         first_party: catalog ? catalog[:first_party] : false,
         requires_credentials: catalog ? catalog[:requires_credentials] : [],
-        launchable: catalog ? catalog[:sandbox] : false,
+        # A runtime is already running — it was started from Settings ->
+        # Integrations — so there is nothing here to launch.
+        launchable: catalog && !runtime ? catalog[:sandbox] : false,
         sandbox_type: catalog&.fetch(:sandbox_type, nil),
         # Catalog membership is what "known" means — a server detected purely
         # from traffic is real but undocumented here, and the view says so.
         known: !catalog.nil?,
+        runtime: runtime,
         status: server_status(calls, configured, catalog),
         calls: calls,
         errors: bucket ? bucket[:errors] : 0,

data/config/routes.rb

@@ -71,8 +71,8 @@ ActionAgent::Engine.routes.draw do
       end
     end
 
-    # Sandboxes. The engine ships the in-memory backend; an operator registers
-    # real ones (see ActionAgent.sandbox_backends).
+    # Sandboxes. The engine ships the in-memory and local backends; an
+    # operator registers the rest (see ActionAgent.sandbox_backends).
     resources :sandboxes, param: :id, only: [ :index, :create, :show, :destroy ] do
       collection do
         post :compare
@@ -80,6 +80,12 @@ ActionAgent::Engine.routes.draw do
       member do
         post :run
       end
+      # Claude Code sessions in an app_runtime sandbox's checkout.
+      resources :code_sessions, only: [ :index, :create, :show ] do
+        member do
+          post :cancel
+        end
+      end
     end
 
     # Tool inventory — auto-detected from the tool roster each generation
@@ -151,7 +157,20 @@ ActionAgent::Engine.routes.draw do
     # Credentials: dashboard API keys (token shown once on create) and the
     # owner's own LLM provider credentials, both encrypted at rest.
     resources :api_keys, only: [ :index, :create, :destroy ]
-    resources :provider_keys, only: [ :index, :create, :destroy ], param: :provider
+    resources :provider_keys, only: [ :index, :create, :destroy ], param: :provider do
+      # Reachability + model list for host-based providers (Ollama), for a
+      # submitted or the stored host. Read-only.
+      post :test, on: :collection
+    end
+
+    # The owner's GitHub connection: the OAuth web flow (connect redirects to
+    # GitHub, which returns to callback) and the repositories it makes
+    # available to checkout sandboxes.
+    resource :github_connection, only: [ :show, :update, :destroy ], controller: "github_connections" do
+      get :repositories
+      get :connect
+      get :callback
+    end
 
     # Model catalogs for the agent builder (Ollama queried live from the
     # configured host; hosted providers curated).

data/lib/action_agent/engine.rb

@@ -24,6 +24,7 @@ module ActionAgent
       "mcp_client" => "MCPClient",
       "mcp_tool_dispatcher" => "MCPToolDispatcher",
       "mcp_controller" => "MCPController",
+      "mcp_dashboard_tools" => "MCPDashboardTools",
       "mcp_recording_middleware" => "MCPRecordingMiddleware",
       "mcp_servers_controller" => "MCPServersController",
       "playwright_mcp_client" => "PlaywrightMCPClient"

data/lib/action_agent/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ActionAgent
-  VERSION = "1.7.2"
+  VERSION = "1.8.0"
 end

data/lib/action_agent.rb

@@ -104,6 +104,9 @@ require "action_agent/compatibility"
 #   end
 #
 module ActionAgent
+  # What ActionAgent.claude_code_auth may be set to.
+  CLAUDE_CODE_AUTH_MODES = %i[api_key local_login].freeze
+
   class << self
     # Deprecation warnings for this gem, routed through Rails' machinery so a
     # host app can silence or escalate them like any other.
@@ -194,9 +197,10 @@ module ActionAgent
     # @return [String, nil]
     attr_accessor :layout
 
-    # Which sandbox backend to provision with: :mock (the only one the
-    # engine ships — an in-memory fake that runs nothing) or the name of a
-    # backend the host registered in sandbox_backends. An unregistered name
+    # Which sandbox backend to provision with: :mock (an in-memory fake that
+    # runs nothing), :local (checkouts cloned and booted as child processes
+    # of the dashboard itself — see local_sandboxes_enabled), or the name of
+    # a backend the host registered in sandbox_backends. An unregistered name
     # falls back to :mock with a logged warning.
     # @return [Symbol]
     attr_accessor :sandbox_service
@@ -304,6 +308,74 @@ module ActionAgent
     # @return [Hash{String => String}]
     attr_accessor :sandbox_backends
 
+    # Whether the :local sandbox backend may run. It clones the owner's
+    # repository onto the dashboard's own machine and runs its setup and
+    # server as child processes — the owner's code, with the dashboard's
+    # privileges — so it is for a developer's machine or a single-user
+    # install. Unset, it follows the environment: on in development and
+    # test, off everywhere else.
+    # @return [Boolean, nil]
+    attr_writer :local_sandboxes_enabled
+
+    # Where the :local backend keeps each sandbox's checkout, logs and
+    # process state (one directory per session). Unset, tmp/action_agent/sandboxes
+    # under the host app.
+    # @return [String, Pathname, nil]
+    attr_writer :local_sandbox_root
+
+    # How long the :local backend waits for a checkout's setup and server to
+    # come up before giving up, in seconds.
+    # @return [Integer]
+    attr_accessor :local_sandbox_boot_timeout
+
+    # The Claude Code executable a sandbox backend runs headless sessions
+    # with. The :local backend runs it on the dashboard's machine.
+    # @return [String]
+    attr_accessor :claude_code_command
+
+    # The permission mode Claude Code sessions run in. "acceptEdits" lets a
+    # session edit files in the checkout and run filesystem commands; with
+    # nobody to answer prompts, anything else that would ask is denied.
+    # @return [String]
+    attr_accessor :claude_code_permission_mode
+
+    # A cap on agentic turns per Claude Code session (nil for Claude Code's
+    # own default).
+    # @return [Integer, nil]
+    attr_accessor :claude_code_max_turns
+
+    # How long a Claude Code session may run before it is stopped, in
+    # seconds.
+    # @return [Integer]
+    attr_accessor :claude_code_timeout
+
+    # How Claude Code sessions authenticate.
+    #
+    # :api_key (the default) runs them on the Anthropic API key the owner
+    # connected in Settings -> Integrations, handed to the session as
+    # ANTHROPIC_API_KEY. It is the only credential the dashboard stores:
+    # Anthropic does not let third-party products collect, store or route
+    # requests through Claude.ai subscription credentials
+    # (https://code.claude.com/docs/en/legal-and-compliance.md).
+    #
+    # :local_login runs `claude` on whatever login this machine's user set up
+    # with `claude /login` (or `claude auth login`), which Claude Code keeps
+    # under ~/.claude or in the keychain. The dashboard never reads, copies
+    # or stores it; it only asks `claude auth status` whether there is one.
+    # That login is the dashboard user's own, so this works with the :local
+    # sandbox backend only, and other backends refuse Claude Code sessions.
+    # @return [Symbol] :api_key or :local_login
+    attr_reader :claude_code_auth
+
+    def claude_code_auth=(value)
+      mode = value.to_s.to_sym
+      unless CLAUDE_CODE_AUTH_MODES.include?(mode)
+        raise ArgumentError, "ActionAgent.claude_code_auth must be :api_key or :local_login, not #{value.inspect}"
+      end
+
+      @claude_code_auth = mode
+    end
+
     # Whether the dashboard may execute agents against real providers.
     # Disable to run the dashboard as a read-only observability surface.
     # @return [Boolean]
@@ -415,6 +487,20 @@ module ActionAgent
     # @return [Boolean]
     attr_accessor :encrypt_credentials
 
+    # The GitHub OAuth App the dashboard's "Connect GitHub" flow authorizes
+    # against (Settings -> Integrations). Unset, each falls back to
+    # GITHUB_CLIENT_ID / GITHUB_CLIENT_SECRET, and the dashboard offers no
+    # connection when neither is present. Register the app's callback URL as
+    # <mount>/api/github_connection/callback.
+    # @return [String, nil]
+    attr_writer :github_client_id, :github_client_secret
+
+    # OAuth scopes requested on connect. +repo+ reaches private repositories
+    # so a sandbox can clone them; narrow it to "public_repo read:user" for
+    # public checkouts only.
+    # @return [String]
+    attr_accessor :github_oauth_scopes
+
     # MCP servers the host app itself serves or connects, appended to the
     # built-in catalog (MCPCatalog) so the MCP Services view lists them and
     # telemetry traffic attributes to them. Each entry is a hash shaped like
@@ -452,6 +538,17 @@ module ActionAgent
     # @return [Boolean]
     attr_accessor :mcp_schema_tools
 
+    # Whether the MCP facade (POST <mount>/mcp) offers the dashboard's own
+    # evaluation and telemetry tools — evaluations_list, evaluations_get,
+    # evaluations_run, evaluation_runs_get, evaluation_runs_compare,
+    # traces_search, traces_get — so a client's coding harness can run an
+    # agent's evaluations and read its traces while it edits the agent. Each
+    # reads under the key's owner, as the dashboard's JSON API reads under the
+    # signed-in owner. On by default; set it to false to leave the facade
+    # serving agents and schema tools only.
+    # @return [Boolean]
+    attr_accessor :mcp_dashboard_tools
+
     # Directory scanned for SchemaTools subclasses when {#schema_tools} is
     # unset. Relative to the host's root. Set to nil to disable discovery and
     # require an explicit declaration. Classes built at runtime with
@@ -471,6 +568,20 @@ module ActionAgent
     # Returns whether multi-tenant mode is enabled.
     #
     # @return [Boolean]
+    def github_client_id
+      @github_client_id.presence || ENV["GITHUB_CLIENT_ID"].presence
+    end
+
+    def github_client_secret
+      @github_client_secret.presence || ENV["GITHUB_CLIENT_SECRET"].presence
+    end
+
+    # Whether the GitHub OAuth flow can run on this install.
+    # @return [Boolean]
+    def github_oauth_configured?
+      github_client_id.present? && github_client_secret.present?
+    end
+
     def multi_tenant?
       @multi_tenant == true
     end
@@ -482,6 +593,14 @@ module ActionAgent
       @mcp_schema_tools != false
     end
 
+    # Whether the MCP facade serves the dashboard's evaluation and telemetry
+    # tools.
+    #
+    # @return [Boolean]
+    def mcp_dashboard_tools?
+      @mcp_dashboard_tools != false
+    end
+
     # Returns whether agent execution is permitted.
     #
     # @return [Boolean]
@@ -499,6 +618,19 @@ module ActionAgent
       Rails.env.local?
     end
 
+    # Whether the :local sandbox backend may run on this install.
+    # @return [Boolean]
+    def local_sandboxes_enabled?
+      return @local_sandboxes_enabled == true unless @local_sandboxes_enabled.nil?
+
+      Rails.env.local?
+    end
+
+    # @return [Pathname]
+    def local_sandbox_root
+      Pathname.new(@local_sandbox_root.presence || Rails.root.join("tmp", "action_agent", "sandboxes"))
+    end
+
     # Tells the host app that +owner+ performed +kind+. Never raises: a
     # bookkeeping failure must not fail the action that was already taken.
     def record_usage(owner, kind)
@@ -633,6 +765,14 @@ module ActionAgent
       @quota_checker = nil
       @provider_credentials_resolver = nil
       @sandbox_backends = {}
+      @local_sandboxes_enabled = nil
+      @local_sandbox_root = nil
+      @local_sandbox_boot_timeout = 600
+      @claude_code_command = "claude"
+      @claude_code_permission_mode = "acceptEdits"
+      @claude_code_max_turns = nil
+      @claude_code_timeout = 1800
+      @claude_code_auth = :api_key
       @execution_enabled = true
       @run_host_agent_classes = false
       @assistant_enabled = nil
@@ -641,6 +781,9 @@ module ActionAgent
       @table_name_prefix = "active_agent_"
       @agent_polymorphic_name = nil
       @encrypt_credentials = true
+      @github_client_id = nil
+      @github_client_secret = nil
+      @github_oauth_scopes = "repo read:user"
       @trace_retention = nil
       @trace_owner_resolver = nil
       @usage_recorder = nil
@@ -653,6 +796,7 @@ module ActionAgent
       @schema_tools = nil
       @schema_tools_path = "app/agent_tools"
       @mcp_schema_tools = nil
+      @mcp_dashboard_tools = nil
     end
 
     # Host-declared schema tool classes, resolved from names and filtered to