actionagent 1.7.2 → 1.8.0

data/app/services/action_agent/dashboard_assistant_service.rb

@@ -31,7 +31,7 @@ module ActionAgent
     PROCESSING_DISCLOSURE = "The selected provider receives your current message, bounded conversation history, and authorized report excerpts requested through assistant tools."
     LIMITATIONS = [
       "Reports describe recorded behavior; no repository branch or current main has been verified.",
-      "GitHub connections, COI execution, and native Claude Code session connections are not implemented here.",
+      "This assistant cannot connect GitHub, start checkout sandboxes, or run Claude Code sessions: do that in Settings → Integrations. COI execution is not available.",
       "Agent proposals are drafts only. Review them in the builder before saving or running."
     ].freeze
     INSTRUCTIONS = <<~TEXT.freeze
@@ -55,9 +55,12 @@ module ActionAgent
       agents. These groups do not provide repository editing, arbitrary browser
       automation, or private database access. Instructions alone do not add tools
       or data access. Explain missing capabilities when proposing an agent.
-      GitHub auth, repo checkout, COI, native Claude Code sessions, running
-      evaluations, and publishing PRs are not available in this version. Explain
-      those limitations without suggesting fake authentication links.
+      You cannot connect GitHub, start checkout sandboxes, run Claude Code
+      sessions, run evaluations, or publish PRs. The developer connects GitHub
+      and Claude Code, starts checkout sandboxes, and runs Claude Code sessions
+      in Settings → Integrations; point them there instead of claiming a sandbox
+      or session started. COI execution is not available in this version.
+      Explain those limitations without suggesting fake authentication links.
     TEXT
     TOOL_DEFINITIONS = [
       {
@@ -107,7 +110,7 @@ module ActionAgent
         providers: DEFAULT_MODELS.map { |id, model| { id: id, configured: provider_configured?(id), default_model: model } },
         defaults: { provider: nil, model: nil },
         processing: { consent_required: true, disclosure: PROCESSING_DISCLOSURE },
-        connections: %i[github coi claude_code].index_with { { supported: false } },
+        connections: connections,
         limits: { message_characters: MAX_MESSAGE_CHARACTERS, history_messages: MAX_HISTORY_MESSAGES, history_characters: MAX_HISTORY_CHARACTERS },
         limitations: LIMITATIONS
       }
@@ -191,6 +194,45 @@ module ActionAgent
 
     private
 
+    # What the owner has set up in Settings → Integrations, reported by the
+    # assistant's configuration endpoint (booleans only, never a token). The
+    # model is not told: it starts nothing, and sandboxes and Claude Code
+    # sessions are started from that view (see LIMITATIONS).
+    #
+    # Claude Code is connected by ClaudeCodeAuth's rule, as the sandbox
+    # listing reports it: an API key the owner connected (auth "api_key"), or
+    # this machine's own login (auth "local_login", with its status).
+    def connections
+      claude_code = ClaudeCodeAuth.status(ProviderKey.for_owner(@owner))
+      {
+        github: { supported: true, connected: GithubConnection.for_owner(@owner).exists? },
+        claude_code: {
+          supported: code_sessions_supported?,
+          connected: claude_code[:connected],
+          auth: claude_code[:mode],
+          login: claude_code[:login]
+        }.compact,
+        coi: { supported: false }
+      }
+    end
+
+    # Claude Code needs a sandbox backend that runs sessions, which :mock and
+    # :local do and a host's may not. A backend that cannot even be loaded (a
+    # misspelled class in ActionAgent.sandbox_backends, or a class file that
+    # requires an SDK the host doesn't bundle) runs none, and must not take
+    # the assistant's configuration down with it. The SDK case raises
+    # LoadError, a ScriptError rather than a StandardError.
+    #
+    # Nor can one whose Claude Code authentication does not work there
+    # (ActionAgent.claude_code_auth = :local_login needs :local).
+    def code_sessions_supported?
+      orchestrator = SandboxOrchestrator.new
+      orchestrator.supports?(:code_session) && ClaudeCodeAuth.backend_refusal(orchestrator).nil?
+    rescue StandardError, LoadError => e
+      Rails.logger.warn("[ActionAgent] sandbox backend unavailable: #{e.message}")
+      false
+    end
+
     def require_processing_consent!
       return if @allow_provider_processing == true
 

data/app/services/action_agent/evaluation_tool_resolver.rb

@@ -80,6 +80,24 @@ module ActionAgent
       configured_keys.to_a
     end
 
+    # The tools the agent's entry for +key+ allows, or nil when that entry
+    # names none — which offers every tool the server serves. This is the rule
+    # AgentToolRoster#allowed_tools reads for the Tools tab, which saves
+    # {key, name, tools: [...]} when some are switched off and tools: [] when
+    # all are: a later entry for the same key wins, as it does there.
+    #
+    # @param key [String] a server key
+    # @return [Array<String>, nil]
+    def allowed_tools_for(key)
+      entry = configured_entries.select { |candidate| normalize(entry_key(candidate)) == normalize(key) }.last
+      return nil unless entry.respond_to?(:key?)
+
+      names = entry["tools"] || entry[:tools]
+      return nil if names.nil?
+
+      Array(names).filter_map { |tool| (tool.respond_to?(:key?) ? tool["name"] || tool[:name] : tool).to_s.strip.presence }
+    end
+
     private
 
     # The catalog's name when it has one; otherwise the name the agent's

data/app/services/action_agent/github_client.rb

@@ -0,0 +1,111 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  # The few GitHub calls the dashboard makes: the OAuth code exchange, the
+  # authenticated user, and the repositories that user can reach. Plain
+  # Net::HTTP, like the provider model lookups, so the engine carries no
+  # GitHub SDK.
+  class GithubClient
+    API = "https://api.github.com"
+    TOKEN_URL = "https://github.com/login/oauth/access_token"
+    AUTHORIZE_URL = "https://github.com/login/oauth/authorize"
+    TIMEOUT_SECONDS = 8
+    # 100 per page is GitHub's maximum; five pages bounds a picker at 500.
+    PER_PAGE = 100
+    MAX_PAGES = 5
+
+    class Error < StandardError; end
+    # The token was revoked or expired: the owner has to connect again.
+    class Unauthorized < Error; end
+
+    def self.authorize_url(redirect_uri:, state:)
+      query = {
+        client_id: ActionAgent.github_client_id,
+        redirect_uri: redirect_uri,
+        scope: ActionAgent.github_oauth_scopes,
+        state: state,
+        allow_signup: "false"
+      }.to_query
+
+      "#{AUTHORIZE_URL}?#{query}"
+    end
+
+    # Trades an OAuth code for { access_token:, scope: }.
+    def self.exchange_code(code:, redirect_uri:)
+      uri = URI.parse(TOKEN_URL)
+      request = Net::HTTP::Post.new(uri, "Accept" => "application/json")
+      request.set_form_data(
+        client_id: ActionAgent.github_client_id,
+        client_secret: ActionAgent.github_client_secret,
+        code: code,
+        redirect_uri: redirect_uri
+      )
+      data = perform(uri, request)
+      raise Error, data["error_description"].presence || data["error"] if data["error"].present?
+      raise Error, "GitHub returned no access token" if data["access_token"].blank?
+
+      { access_token: data["access_token"], scope: data["scope"].to_s }
+    end
+
+    def self.perform(uri, request)
+      response = Net::HTTP.start(
+        uri.host, uri.port,
+        use_ssl: true, open_timeout: TIMEOUT_SECONDS, read_timeout: TIMEOUT_SECONDS
+      ) { |http| http.request(request) }
+
+      raise Unauthorized, "GitHub rejected the token" if response.code.to_i == 401
+      raise Error, "GitHub answered #{response.code}" unless response.code.to_i.between?(200, 299)
+
+      JSON.parse(response.body.presence || "{}")
+    rescue JSON::ParserError
+      raise Error, "GitHub answered with something other than JSON"
+    rescue Timeout::Error, SocketError, SystemCallError, OpenSSL::SSL::SSLError => e
+      raise Error, "GitHub is unreachable (#{e.class.name})"
+    end
+
+    def initialize(access_token)
+      @access_token = access_token
+    end
+
+    def user
+      get("/user")
+    end
+
+    # Every repository the token reaches (owned, collaborated on, or through
+    # an organization), most recently pushed first, reduced to the fields the
+    # dashboard stores.
+    def repositories
+      (1..MAX_PAGES).each_with_object([]) do |page, all|
+        batch = get("/user/repos", per_page: PER_PAGE, page: page, sort: "pushed",
+          affiliation: "owner,collaborator,organization_member")
+        all.concat(Array(batch).map { |repo| self.class.slice_repository(repo) })
+        break all if Array(batch).size < PER_PAGE
+      end
+    end
+
+    def self.slice_repository(repo)
+      {
+        "id" => repo["id"],
+        "full_name" => repo["full_name"],
+        "private" => repo["private"] == true,
+        "default_branch" => repo["default_branch"].presence || "main",
+        "description" => repo["description"],
+        "html_url" => repo["html_url"],
+        "pushed_at" => repo["pushed_at"]
+      }
+    end
+
+    private
+
+    def get(path, params = {})
+      uri = URI.parse("#{API}#{path}")
+      uri.query = params.to_query if params.any?
+      request = Net::HTTP::Get.new(uri,
+        "Accept" => "application/vnd.github+json",
+        "Authorization" => "Bearer #{@access_token}",
+        "X-GitHub-Api-Version" => "2022-11-28",
+        "User-Agent" => "activeagent-dashboard")
+      self.class.perform(uri, request)
+    end
+  end
+end