actionagent 1.7.2 → 1.8.0

data/lib/generators/action_agent/install_generator.rb

@@ -102,11 +102,38 @@ module ActionAgent
       # shipped. Emitted after them, so on a fresh install it runs once the
       # table exists, finds the columns the create-table migration made, and
       # changes nothing.
-      return if existing_migration?("add_evaluation_report_identity")
+      unless existing_migration?("add_evaluation_report_identity")
+        migration_template(
+          "add_evaluation_report_identity.rb.erb",
+          "db/migrate/add_evaluation_report_identity.rb"
+        )
+      end
+
+      # A remote Ollama's optional API key arrived after the dashboard tables
+      # shipped. Guarded, so on a fresh install it finds the column the
+      # create-table migration made and changes nothing.
+      unless existing_migration?("add_provider_key_api_key")
+        migration_template(
+          "add_provider_key_api_key.rb.erb",
+          "db/migrate/add_provider_key_api_key.rb"
+        )
+      end
+
+      # GitHub connections and checkout sandboxes, likewise later than the
+      # dashboard tables.
+      unless existing_migration?("create_active_agent_github_connections")
+        migration_template(
+          "create_active_agent_github_connections.rb.erb",
+          "db/migrate/create_active_agent_github_connections.rb"
+        )
+      end
+
+      # Claude Code sessions inside those checkouts.
+      return if existing_migration?("create_active_agent_code_sessions")
 
       migration_template(
-        "add_evaluation_report_identity.rb.erb",
-        "db/migrate/add_evaluation_report_identity.rb"
+        "create_active_agent_code_sessions.rb.erb",
+        "db/migrate/create_active_agent_code_sessions.rb"
       )
     end
 

data/lib/generators/action_agent/templates/action_agent.rb.erb

@@ -106,6 +106,50 @@ ActionAgent.configure do |config|
   #
   # config.assistant_enabled = true
 
+  # ==========================================================================
+  # Sandboxes
+  # ==========================================================================
+  #
+  # Which backend boots sandboxes: :mock (the default, in memory, runs
+  # nothing), :local, or one you register in sandbox_backends to run them in
+  # containers. The SANDBOX_BACKEND environment variable overrides it.
+  #
+  # config.sandbox_service = :local
+  # config.sandbox_backends = { "cloud_run" => "CloudRunService" }
+  #
+  # :local clones a repository connected in Settings -> Integrations onto
+  # this machine and boots it as child processes of the dashboard, as the
+  # checkout's .activeagents/sandbox.yml says. That runs the repository's
+  # code, and Claude Code sessions in it, with the dashboard's privileges, so
+  # it is off outside development and test until you enable it here.
+  #
+  # config.local_sandboxes_enabled = true
+  # config.local_sandbox_root = Rails.root.join("tmp/action_agent/sandboxes")
+  # config.local_sandbox_boot_timeout = 600   # seconds, for checkout, setup and boot
+  #
+  # Claude Code sessions in a ready checkout. Nobody is there to answer a
+  # permission prompt: "acceptEdits" lets a session edit files in the
+  # checkout and run filesystem commands, and anything else that would ask
+  # is denied.
+  #
+  # config.claude_code_command = "claude"
+  # config.claude_code_permission_mode = "acceptEdits"
+  # config.claude_code_max_turns = nil        # Claude Code's own default
+  # config.claude_code_timeout = 1800         # seconds
+  #
+  # How sessions authenticate. :api_key (the default) uses the Anthropic API
+  # key connected in Settings -> Integrations (from the Claude Console,
+  # https://platform.claude.com). :local_login, with the :local backend only,
+  # uses this machine's own Claude Code login (`claude /login`); the dashboard
+  # never reads or stores it. Claude subscription tokens (`claude
+  # setup-token`) are not accepted: Anthropic does not allow third-party apps
+  # to hold Claude.ai credentials.
+  #
+  # config.claude_code_auth = :local_login
+  #
+  # Expired sandboxes are stopped by `bin/rails action_agent:sandbox:reap`.
+  # Schedule it every few minutes.
+
   # ==========================================================================
   # UI
   # ==========================================================================

data/lib/generators/action_agent/templates/add_provider_key_api_key.rb.erb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+# Adds the optional api_key column to provider keys: a host-based provider
+# (Ollama) can be a remote server behind an authenticating proxy, or Ollama
+# Cloud, and then needs a Bearer key alongside its host URL. Emitted for an
+# install whose dashboard tables predate it; the create-table migration
+# carries the column for a fresh install. Guarded, so it is safe to re-run.
+class AddProviderKeyApiKey < ActiveRecord::Migration<%= migration_version %>
+  def up
+    return unless table_exists?(table)
+    return if column_exists?(table, :api_key)
+
+    add_column table, :api_key, :string
+  end
+
+  def down
+    remove_column table, :api_key if table_exists?(table) && column_exists?(table, :api_key)
+  end
+
+  private
+
+  def table
+    "#{ActionAgent.table_name_prefix}provider_keys"
+  end
+end

data/lib/generators/action_agent/templates/create_active_agent_code_sessions.rb.erb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+# Claude Code sessions run inside an app_runtime sandbox's checkout: the
+# prompt, the scrubbed stream-json transcript, the reported outcome and the
+# resulting diff. Emitted alongside the dashboard tables on a fresh install,
+# and on its own for an install that predates it.
+#
+# Table names follow ActionAgent.table_name_prefix, and JSON columns are
+# jsonb on PostgreSQL and json elsewhere, the same way as
+# create_active_agent_dashboard_tables.
+class CreateActiveAgentCodeSessions < ActiveRecord::Migration<%= migration_version %>
+  def change
+    prefix = ActionAgent.table_name_prefix
+
+    create_table "#{prefix}code_sessions" do |t|
+      t.bigint :sandbox_session_id, null: false
+      t.text :prompt, null: false
+      t.integer :status, default: 0, null: false
+      t.column :events, json_type, **json_default([])
+      t.integer :dropped_events_count, default: 0, null: false
+      t.text :result
+      t.text :diff
+      t.text :error_message
+      t.string :model
+      t.string :claude_session_id
+      t.integer :num_turns
+      t.integer :duration_ms
+      t.decimal :total_cost_usd, precision: 12, scale: 6
+      t.integer :input_tokens
+      t.integer :output_tokens
+      t.datetime :started_at
+      t.datetime :finished_at
+      t.bigint :user_id
+      t.bigint :account_id
+      t.timestamps
+      t.index :sandbox_session_id
+      t.index :user_id
+      t.index :account_id
+    end
+  end
+
+  private
+
+  def json_type
+    @json_type ||= postgres? ? :jsonb : :json
+  end
+
+  # MySQL rejects a default on a JSON column outright, so the column is
+  # created without one there.
+  def json_default(value, null: nil)
+    return {} unless postgres?
+
+    null.nil? ? { default: value } : { default: value, null: null }
+  end
+
+  def postgres?
+    connection.adapter_name.to_s.downcase.include?("postgres")
+  end
+end

data/lib/generators/action_agent/templates/create_active_agent_dashboard_tables.rb.erb

@@ -326,6 +326,8 @@ class CreateActiveAgentDashboardTables < ActiveRecord::Migration<%= migration_ve
     create_table "#{prefix}provider_keys" do |t|
       t.string :provider, null: false
       t.string :credential, null: false
+      # Optional Bearer key for a host-based provider (remote Ollama).
+      t.string :api_key
       t.bigint :user_id
       t.bigint :account_id
       t.timestamps

data/lib/generators/action_agent/templates/create_active_agent_github_connections.rb.erb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+# GitHub connections: an owner's OAuth grant (Settings -> Integrations), the
+# repositories they made available to the workspace, and the checkout a
+# sandbox session boots its app runtime from. Emitted alongside the dashboard
+# tables on a fresh install, and on its own for an install that predates it.
+#
+# Table names follow ActionAgent.table_name_prefix, and JSON columns are
+# jsonb on PostgreSQL and json elsewhere, the same way as
+# create_active_agent_dashboard_tables.
+class CreateActiveAgentGithubConnections < ActiveRecord::Migration<%= migration_version %>
+  def change
+    prefix = ActionAgent.table_name_prefix
+
+    create_table "#{prefix}github_connections" do |t|
+      # The OAuth access token, encrypted at rest (text: ciphertext is longer
+      # than the token).
+      t.text :access_token, null: false
+      t.bigint :github_user_id, null: false
+      t.string :login, null: false
+      t.string :avatar_url
+      t.string :scopes
+      # The repositories the owner made available, as GitHub described them
+      # when they were chosen: full_name, id, private, default_branch.
+      t.column :repositories, json_type, **json_default([])
+      t.bigint :user_id
+      t.bigint :account_id
+      t.timestamps
+      t.index :account_id
+      t.index :user_id
+    end
+
+    # A sandbox booted from a checkout of one of those repositories, and the
+    # app runtime's MCP endpoint (and the bearer token it expects, encrypted)
+    # once the backend reports them.
+    change_table "#{prefix}sandbox_sessions" do |t|
+      t.string :repository
+      t.string :repository_ref
+      t.string :runtime_mcp_url
+      t.text :runtime_mcp_token
+    end
+  end
+
+  private
+
+  def json_type
+    @json_type ||= postgres? ? :jsonb : :json
+  end
+
+  # MySQL rejects a default on a JSON column outright, so the column is
+  # created without one there.
+  def json_default(value, null: nil)
+    return {} unless postgres?
+
+    null.nil? ? { default: value } : { default: value, null: null }
+  end
+
+  def postgres?
+    connection.adapter_name.to_s.downcase.include?("postgres")
+  end
+end

data/lib/tasks/claude_code.rake

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+namespace :action_agent do
+  namespace :claude_code do
+    # Earlier versions accepted a `claude setup-token` token (a Claude
+    # subscription credential) for the Claude Code connection. Anthropic does
+    # not let third-party products store those, and they are no longer used;
+    # this removes the ones still stored. Run it once after upgrading.
+    desc "Delete stored Claude Code connections holding a Claude subscription token (sk-ant-oat…), " \
+         "which are no longer used; their owners connect an Anthropic API key instead"
+    task purge_subscription_tokens: :environment do
+      count = ActionAgent::ProviderKey.purge_subscription_tokens!
+      puts "Deleted #{count} stored Claude subscription token(s)"
+    end
+  end
+end

data/lib/tasks/sandbox.rake

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+namespace :action_agent do
+  namespace :sandbox do
+    desc "Write this app's checkout sandbox runtime manifest ({mcp_path, mcp_token}) to " \
+         "$ACTION_AGENT_SANDBOX_MANIFEST, or print it"
+    task manifest: :environment do
+      manifest = JSON.generate(ActionAgent::SandboxManifest.generate)
+
+      if (path = ENV[ActionAgent::SandboxManifest::PATH_ENV].presence)
+        File.write(path, manifest)
+      else
+        puts manifest
+      end
+    rescue ActionAgent::SandboxManifest::Error => e
+      abort "action_agent:sandbox:manifest: #{e.message}"
+    end
+
+    desc "Expire sandbox sessions past their expiry and release what their backend holds " \
+         "(processes, containers). Schedule it, e.g. every few minutes."
+    task reap: :environment do
+      count = ActionAgent::SandboxCleanupJob.cleanup_expired!
+      puts "Expired #{count.to_i} sandbox session(s)"
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: actionagent
 version: !ruby/object:Gem::Version
-  version: 1.7.2
+  version: 1.8.0
 platform: ruby
 authors:
 - Justin Bowen
@@ -129,9 +129,11 @@ files:
 - app/controllers/action_agent/api/analytics_controller.rb
 - app/controllers/action_agent/api/api_keys_controller.rb
 - app/controllers/action_agent/api/base_controller.rb
+- app/controllers/action_agent/api/code_sessions_controller.rb
 - app/controllers/action_agent/api/dashboard_assistant_controller.rb
 - app/controllers/action_agent/api/evaluation_reports_controller.rb
 - app/controllers/action_agent/api/evaluations_controller.rb
+- app/controllers/action_agent/api/github_connections_controller.rb
 - app/controllers/action_agent/api/instance_tiers_controller.rb
 - app/controllers/action_agent/api/interaction_messages_controller.rb
 - app/controllers/action_agent/api/interactions_controller.rb
@@ -151,9 +153,13 @@ files:
 - app/controllers/action_agent/dashboard_controller.rb
 - app/controllers/action_agent/traces_controller.rb
 - app/controllers/concerns/action_agent/api/agent_serialization.rb
+- app/controllers/concerns/action_agent/api/evaluation_run_starting.rb
 - app/controllers/concerns/action_agent/api/ingest_authentication.rb
+- app/controllers/concerns/action_agent/api/mcp_dashboard_tools.rb
+- app/controllers/concerns/action_agent/api/run_sandbox.rb
 - app/jobs/action_agent/agent_execution_job.rb
 - app/jobs/action_agent/application_job.rb
+- app/jobs/action_agent/code_session_job.rb
 - app/jobs/action_agent/evaluation_run_job.rb
 - app/jobs/action_agent/process_telemetry_traces_job.rb
 - app/jobs/action_agent/sandbox_cleanup_job.rb
@@ -171,10 +177,12 @@ files:
 - app/models/action_agent/agent_version.rb
 - app/models/action_agent/api_key.rb
 - app/models/action_agent/application_record.rb
+- app/models/action_agent/code_session.rb
 - app/models/action_agent/evaluation.rb
 - app/models/action_agent/evaluation_run.rb
 - app/models/action_agent/evaluation_scenario.rb
 - app/models/action_agent/evaluation_scenario_result.rb
+- app/models/action_agent/github_connection.rb
 - app/models/action_agent/model_pricing.rb
 - app/models/action_agent/provider_key.rb
 - app/models/action_agent/recording_action.rb
@@ -190,6 +198,7 @@ files:
 - app/queries/action_agent/agent_executions.rb
 - app/queries/action_agent/metrics_report.rb
 - app/serializers/action_agent/agent_message_serializer.rb
+- app/serializers/action_agent/evaluation_serializer.rb
 - app/serializers/action_agent/interaction_preview.rb
 - app/serializers/action_agent/telemetry_trace_serializer.rb
 - app/serializers/action_agent/trace_interaction_serializer.rb
@@ -200,19 +209,27 @@ files:
 - app/services/action_agent/agent_sync.rb
 - app/services/action_agent/agent_tool_roster.rb
 - app/services/action_agent/agent_toolbox.rb
+- app/services/action_agent/claude_code_auth.rb
 - app/services/action_agent/dashboard_assistant_service.rb
 - app/services/action_agent/evaluation_evidence.rb
 - app/services/action_agent/evaluation_report_import.rb
 - app/services/action_agent/evaluation_runner_service.rb
 - app/services/action_agent/evaluation_tool_resolver.rb
+- app/services/action_agent/github_client.rb
+- app/services/action_agent/local_sandbox_backend.rb
+- app/services/action_agent/local_sandbox_databases.rb
 - app/services/action_agent/mcp_catalog.rb
 - app/services/action_agent/mcp_client.rb
 - app/services/action_agent/mcp_recording_middleware.rb
 - app/services/action_agent/mcp_tool_dispatcher.rb
 - app/services/action_agent/mock_sandbox_backend.rb
+- app/services/action_agent/ollama_host_probe.rb
+- app/services/action_agent/payload_bounds.rb
 - app/services/action_agent/playwright_mcp_client.rb
+- app/services/action_agent/sandbox_manifest.rb
 - app/services/action_agent/sandbox_orchestrator.rb
 - app/services/action_agent/scenario_evaluation_runner.rb
+- app/services/action_agent/secret_scrubber.rb
 - app/services/action_agent/session_recording_service.rb
 - app/services/action_agent/tool_discovery.rb
 - app/views/action_agent/dashboard/index.html.erb
@@ -234,11 +251,16 @@ files:
 - lib/generators/action_agent/templates/add_agent_id_to_active_agent_telemetry_traces.rb.erb
 - lib/generators/action_agent/templates/add_agent_releases.rb.erb
 - lib/generators/action_agent/templates/add_evaluation_report_identity.rb.erb
+- lib/generators/action_agent/templates/add_provider_key_api_key.rb.erb
+- lib/generators/action_agent/templates/create_active_agent_code_sessions.rb.erb
 - lib/generators/action_agent/templates/create_active_agent_dashboard_tables.rb.erb
 - lib/generators/action_agent/templates/create_active_agent_evaluation_scenarios.rb.erb
+- lib/generators/action_agent/templates/create_active_agent_github_connections.rb.erb
 - lib/generators/action_agent/templates/create_active_agent_telemetry_traces.rb.erb
 - lib/generators/action_agent/templates/ensure_agent_release_columns.rb.erb
 - lib/tasks/action_agent.rake
+- lib/tasks/claude_code.rake
+- lib/tasks/sandbox.rake
 homepage: https://activeagents.ai
 licenses:
 - MIT