actionagent 1.7.2 → 1.8.1

data/lib/action_agent.rb

@@ -104,6 +104,9 @@ require "action_agent/compatibility"
 #   end
 #
 module ActionAgent
+  # What ActionAgent.claude_code_auth may be set to.
+  CLAUDE_CODE_AUTH_MODES = %i[api_key local_login].freeze
+
   class << self
     # Deprecation warnings for this gem, routed through Rails' machinery so a
     # host app can silence or escalate them like any other.
@@ -194,9 +197,10 @@ module ActionAgent
     # @return [String, nil]
     attr_accessor :layout
 
-    # Which sandbox backend to provision with: :mock (the only one the
-    # engine ships — an in-memory fake that runs nothing) or the name of a
-    # backend the host registered in sandbox_backends. An unregistered name
+    # Which sandbox backend to provision with: :mock (an in-memory fake that
+    # runs nothing), :local (checkouts cloned and booted as child processes
+    # of the dashboard itself — see local_sandboxes_enabled), or the name of
+    # a backend the host registered in sandbox_backends. An unregistered name
     # falls back to :mock with a logged warning.
     # @return [Symbol]
     attr_accessor :sandbox_service
@@ -304,6 +308,78 @@ module ActionAgent
     # @return [Hash{String => String}]
     attr_accessor :sandbox_backends
 
+    # Whether the :local sandbox backend may run. It clones the owner's
+    # repository onto the dashboard's own machine and runs its setup and
+    # server as child processes — the owner's code, with the dashboard's
+    # privileges — so it is for a developer's machine or a single-user
+    # install. Unset, it follows the environment: on in development and
+    # test, off everywhere else.
+    # @return [Boolean, nil]
+    attr_writer :local_sandboxes_enabled
+
+    # Where the :local backend keeps each sandbox's checkout, logs and
+    # process state (one directory per session). Unset, tmp/action_agent/sandboxes
+    # under the host app.
+    # @return [String, Pathname, nil]
+    attr_writer :local_sandbox_root
+
+    # How long the :local backend waits for a checkout's setup and server to
+    # come up before giving up, in seconds.
+    # @return [Integer]
+    attr_accessor :local_sandbox_boot_timeout
+
+    # The Claude Code executable a sandbox backend runs headless sessions
+    # with. The :local backend runs it on the dashboard's machine.
+    # @return [String]
+    attr_accessor :claude_code_command
+
+    # The permission mode Claude Code sessions run in. "acceptEdits" lets a
+    # session edit files in the checkout and run filesystem commands; with
+    # nobody to answer prompts, anything else that would ask is denied.
+    # @return [String]
+    attr_accessor :claude_code_permission_mode
+
+    # A cap on agentic turns per Claude Code session (nil for Claude Code's
+    # own default).
+    # @return [Integer, nil]
+    attr_accessor :claude_code_max_turns
+
+    # How long a Claude Code session may run before it is stopped, in
+    # seconds.
+    # @return [Integer]
+    attr_accessor :claude_code_timeout
+
+    # Codex CLI sessions use the owner's OpenAI API key and workspace-write
+    # sandboxing. They share checkout lifecycle and cancellation with Claude.
+    attr_accessor :codex_command, :codex_timeout
+
+    # How Claude Code sessions authenticate.
+    #
+    # :api_key (the default) runs them on the Anthropic API key the owner
+    # connected in Settings -> Integrations, handed to the session as
+    # ANTHROPIC_API_KEY. It is the only credential the dashboard stores:
+    # Anthropic does not let third-party products collect, store or route
+    # requests through Claude.ai subscription credentials
+    # (https://code.claude.com/docs/en/legal-and-compliance.md).
+    #
+    # :local_login runs `claude` on whatever login this machine's user set up
+    # with `claude /login` (or `claude auth login`), which Claude Code keeps
+    # under ~/.claude or in the keychain. The dashboard never reads, copies
+    # or stores it; it only asks `claude auth status` whether there is one.
+    # That login is the dashboard user's own, so this works with the :local
+    # sandbox backend only, and other backends refuse Claude Code sessions.
+    # @return [Symbol] :api_key or :local_login
+    attr_reader :claude_code_auth
+
+    def claude_code_auth=(value)
+      mode = value.to_s.to_sym
+      unless CLAUDE_CODE_AUTH_MODES.include?(mode)
+        raise ArgumentError, "ActionAgent.claude_code_auth must be :api_key or :local_login, not #{value.inspect}"
+      end
+
+      @claude_code_auth = mode
+    end
+
     # Whether the dashboard may execute agents against real providers.
     # Disable to run the dashboard as a read-only observability surface.
     # @return [Boolean]
@@ -415,6 +491,20 @@ module ActionAgent
     # @return [Boolean]
     attr_accessor :encrypt_credentials
 
+    # The GitHub OAuth App the dashboard's "Connect GitHub" flow authorizes
+    # against (Settings -> Integrations). Unset, each falls back to
+    # GITHUB_CLIENT_ID / GITHUB_CLIENT_SECRET, and the dashboard offers no
+    # connection when neither is present. Register the app's callback URL as
+    # <mount>/api/github_connection/callback.
+    # @return [String, nil]
+    attr_writer :github_client_id, :github_client_secret
+
+    # OAuth scopes requested on connect. +repo+ reaches private repositories
+    # so a sandbox can clone them; narrow it to "public_repo read:user" for
+    # public checkouts only.
+    # @return [String]
+    attr_accessor :github_oauth_scopes
+
     # MCP servers the host app itself serves or connects, appended to the
     # built-in catalog (MCPCatalog) so the MCP Services view lists them and
     # telemetry traffic attributes to them. Each entry is a hash shaped like
@@ -452,6 +542,17 @@ module ActionAgent
     # @return [Boolean]
     attr_accessor :mcp_schema_tools
 
+    # Whether the MCP facade (POST <mount>/mcp) offers the dashboard's own
+    # evaluation and telemetry tools — evaluations_list, evaluations_get,
+    # evaluations_run, evaluation_runs_get, evaluation_runs_compare,
+    # traces_search, traces_get — so a client's coding harness can run an
+    # agent's evaluations and read its traces while it edits the agent. Each
+    # reads under the key's owner, as the dashboard's JSON API reads under the
+    # signed-in owner. On by default; set it to false to leave the facade
+    # serving agents and schema tools only.
+    # @return [Boolean]
+    attr_accessor :mcp_dashboard_tools
+
     # Directory scanned for SchemaTools subclasses when {#schema_tools} is
     # unset. Relative to the host's root. Set to nil to disable discovery and
     # require an explicit declaration. Classes built at runtime with
@@ -471,6 +572,20 @@ module ActionAgent
     # Returns whether multi-tenant mode is enabled.
     #
     # @return [Boolean]
+    def github_client_id
+      @github_client_id.presence || ENV["GITHUB_CLIENT_ID"].presence
+    end
+
+    def github_client_secret
+      @github_client_secret.presence || ENV["GITHUB_CLIENT_SECRET"].presence
+    end
+
+    # Whether the GitHub OAuth flow can run on this install.
+    # @return [Boolean]
+    def github_oauth_configured?
+      github_client_id.present? && github_client_secret.present?
+    end
+
     def multi_tenant?
       @multi_tenant == true
     end
@@ -482,6 +597,14 @@ module ActionAgent
       @mcp_schema_tools != false
     end
 
+    # Whether the MCP facade serves the dashboard's evaluation and telemetry
+    # tools.
+    #
+    # @return [Boolean]
+    def mcp_dashboard_tools?
+      @mcp_dashboard_tools != false
+    end
+
     # Returns whether agent execution is permitted.
     #
     # @return [Boolean]
@@ -499,6 +622,19 @@ module ActionAgent
       Rails.env.local?
     end
 
+    # Whether the :local sandbox backend may run on this install.
+    # @return [Boolean]
+    def local_sandboxes_enabled?
+      return @local_sandboxes_enabled == true unless @local_sandboxes_enabled.nil?
+
+      Rails.env.local?
+    end
+
+    # @return [Pathname]
+    def local_sandbox_root
+      Pathname.new(@local_sandbox_root.presence || Rails.root.join("tmp", "action_agent", "sandboxes"))
+    end
+
     # Tells the host app that +owner+ performed +kind+. Never raises: a
     # bookkeeping failure must not fail the action that was already taken.
     def record_usage(owner, kind)
@@ -633,6 +769,16 @@ module ActionAgent
       @quota_checker = nil
       @provider_credentials_resolver = nil
       @sandbox_backends = {}
+      @local_sandboxes_enabled = nil
+      @local_sandbox_root = nil
+      @local_sandbox_boot_timeout = 600
+      @claude_code_command = "claude"
+      @claude_code_permission_mode = "acceptEdits"
+      @claude_code_max_turns = nil
+      @claude_code_timeout = 1800
+      @codex_command = "codex"
+      @codex_timeout = 1800
+      @claude_code_auth = :api_key
       @execution_enabled = true
       @run_host_agent_classes = false
       @assistant_enabled = nil
@@ -641,6 +787,9 @@ module ActionAgent
       @table_name_prefix = "active_agent_"
       @agent_polymorphic_name = nil
       @encrypt_credentials = true
+      @github_client_id = nil
+      @github_client_secret = nil
+      @github_oauth_scopes = "repo read:user"
       @trace_retention = nil
       @trace_owner_resolver = nil
       @usage_recorder = nil
@@ -653,6 +802,7 @@ module ActionAgent
       @schema_tools = nil
       @schema_tools_path = "app/agent_tools"
       @mcp_schema_tools = nil
+      @mcp_dashboard_tools = nil
     end
 
     # Host-declared schema tool classes, resolved from names and filtered to

data/lib/generators/action_agent/install_generator.rb

@@ -102,12 +102,42 @@ module ActionAgent
       # shipped. Emitted after them, so on a fresh install it runs once the
       # table exists, finds the columns the create-table migration made, and
       # changes nothing.
-      return if existing_migration?("add_evaluation_report_identity")
+      unless existing_migration?("add_evaluation_report_identity")
+        migration_template(
+          "add_evaluation_report_identity.rb.erb",
+          "db/migrate/add_evaluation_report_identity.rb"
+        )
+      end
 
-      migration_template(
-        "add_evaluation_report_identity.rb.erb",
-        "db/migrate/add_evaluation_report_identity.rb"
-      )
+      # A remote Ollama's optional API key arrived after the dashboard tables
+      # shipped. Guarded, so on a fresh install it finds the column the
+      # create-table migration made and changes nothing.
+      unless existing_migration?("add_provider_key_api_key")
+        migration_template(
+          "add_provider_key_api_key.rb.erb",
+          "db/migrate/add_provider_key_api_key.rb"
+        )
+      end
+
+      # GitHub connections and checkout sandboxes, likewise later than the
+      # dashboard tables.
+      unless existing_migration?("create_active_agent_github_connections")
+        migration_template(
+          "create_active_agent_github_connections.rb.erb",
+          "db/migrate/create_active_agent_github_connections.rb"
+        )
+      end
+
+      # Claude Code sessions inside those checkouts.
+      unless existing_migration?("create_active_agent_code_sessions")
+        migration_template(
+          "create_active_agent_code_sessions.rb.erb",
+          "db/migrate/create_active_agent_code_sessions.rb"
+        )
+      end
+      unless existing_migration?("add_code_session_runner")
+        migration_template("add_code_session_runner.rb.erb", "db/migrate/add_code_session_runner.rb")
+      end
     end
 
     def add_route

data/lib/generators/action_agent/templates/action_agent.rb.erb

@@ -106,6 +106,53 @@ ActionAgent.configure do |config|
   #
   # config.assistant_enabled = true
 
+  # ==========================================================================
+  # Sandboxes
+  # ==========================================================================
+  #
+  # Which backend boots sandboxes: :mock (the default, in memory, runs
+  # nothing), :local, or one you register in sandbox_backends to run them in
+  # containers. The SANDBOX_BACKEND environment variable overrides it.
+  #
+  # config.sandbox_service = :local
+  # config.sandbox_backends = { "cloud_run" => "CloudRunService" }
+  #
+  # :local clones a repository connected in Settings -> Integrations onto
+  # this machine and boots it as child processes of the dashboard, as the
+  # checkout's .activeagents/sandbox.yml says. That runs the repository's
+  # code, and Claude Code sessions in it, with the dashboard's privileges, so
+  # it is off outside development and test until you enable it here.
+  #
+  # config.local_sandboxes_enabled = true
+  # config.local_sandbox_root = Rails.root.join("tmp/action_agent/sandboxes")
+  # config.local_sandbox_boot_timeout = 600   # seconds, for checkout, setup and boot
+  #
+  # Claude Code sessions in a ready checkout. Nobody is there to answer a
+  # permission prompt: "acceptEdits" lets a session edit files in the
+  # checkout and run filesystem commands, and anything else that would ask
+  # is denied.
+  #
+  # config.claude_code_command = "claude"
+  # config.claude_code_permission_mode = "acceptEdits"
+  # config.claude_code_max_turns = nil        # Claude Code's own default
+  # config.claude_code_timeout = 1800         # seconds
+  # Codex uses a separate API-key connection in Settings -> Integrations.
+  # config.codex_command = "codex"
+  # config.codex_timeout = 1800               # seconds
+  #
+  # How sessions authenticate. :api_key (the default) uses the Anthropic API
+  # key connected in Settings -> Integrations (from the Claude Console,
+  # https://platform.claude.com). :local_login, with the :local backend only,
+  # uses this machine's own Claude Code login (`claude /login`); the dashboard
+  # never reads or stores it. Claude subscription tokens (`claude
+  # setup-token`) are not accepted: Anthropic does not allow third-party apps
+  # to hold Claude.ai credentials.
+  #
+  # config.claude_code_auth = :local_login
+  #
+  # Expired sandboxes are stopped by `bin/rails action_agent:sandbox:reap`.
+  # Schedule it every few minutes.
+
   # ==========================================================================
   # UI
   # ==========================================================================

data/lib/generators/action_agent/templates/add_code_session_runner.rb.erb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+class AddCodeSessionRunner < ActiveRecord::Migration<%= migration_version %>
+  def change
+    table = "#{ActionAgent.table_name_prefix}code_sessions"
+    add_column table, :runner, :string, null: false, default: "claude_code" unless column_exists?(table, :runner)
+    add_column table, :runner_session_id, :string unless column_exists?(table, :runner_session_id)
+  end
+end

data/lib/generators/action_agent/templates/add_provider_key_api_key.rb.erb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+# Adds the optional api_key column to provider keys: a host-based provider
+# (Ollama) can be a remote server behind an authenticating proxy, or Ollama
+# Cloud, and then needs a Bearer key alongside its host URL. Emitted for an
+# install whose dashboard tables predate it; the create-table migration
+# carries the column for a fresh install. Guarded, so it is safe to re-run.
+class AddProviderKeyApiKey < ActiveRecord::Migration<%= migration_version %>
+  def up
+    return unless table_exists?(table)
+    return if column_exists?(table, :api_key)
+
+    add_column table, :api_key, :string
+  end
+
+  def down
+    remove_column table, :api_key if table_exists?(table) && column_exists?(table, :api_key)
+  end
+
+  private
+
+  def table
+    "#{ActionAgent.table_name_prefix}provider_keys"
+  end
+end

data/lib/generators/action_agent/templates/create_active_agent_code_sessions.rb.erb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+# Claude Code sessions run inside an app_runtime sandbox's checkout: the
+# prompt, the scrubbed stream-json transcript, the reported outcome and the
+# resulting diff. Emitted alongside the dashboard tables on a fresh install,
+# and on its own for an install that predates it.
+#
+# Table names follow ActionAgent.table_name_prefix, and JSON columns are
+# jsonb on PostgreSQL and json elsewhere, the same way as
+# create_active_agent_dashboard_tables.
+class CreateActiveAgentCodeSessions < ActiveRecord::Migration<%= migration_version %>
+  def change
+    prefix = ActionAgent.table_name_prefix
+
+    create_table "#{prefix}code_sessions" do |t|
+      t.bigint :sandbox_session_id, null: false
+      t.text :prompt, null: false
+      t.integer :status, default: 0, null: false
+      t.column :events, json_type, **json_default([])
+      t.integer :dropped_events_count, default: 0, null: false
+      t.text :result
+      t.text :diff
+      t.text :error_message
+      t.string :model
+      t.string :claude_session_id
+      t.integer :num_turns
+      t.integer :duration_ms
+      t.decimal :total_cost_usd, precision: 12, scale: 6
+      t.integer :input_tokens
+      t.integer :output_tokens
+      t.datetime :started_at
+      t.datetime :finished_at
+      t.bigint :user_id
+      t.bigint :account_id
+      t.timestamps
+      t.index :sandbox_session_id
+      t.index :user_id
+      t.index :account_id
+    end
+  end
+
+  private
+
+  def json_type
+    @json_type ||= postgres? ? :jsonb : :json
+  end
+
+  # MySQL rejects a default on a JSON column outright, so the column is
+  # created without one there.
+  def json_default(value, null: nil)
+    return {} unless postgres?
+
+    null.nil? ? { default: value } : { default: value, null: null }
+  end
+
+  def postgres?
+    connection.adapter_name.to_s.downcase.include?("postgres")
+  end
+end

data/lib/generators/action_agent/templates/create_active_agent_dashboard_tables.rb.erb

@@ -326,6 +326,8 @@ class CreateActiveAgentDashboardTables < ActiveRecord::Migration<%= migration_ve
     create_table "#{prefix}provider_keys" do |t|
       t.string :provider, null: false
       t.string :credential, null: false
+      # Optional Bearer key for a host-based provider (remote Ollama).
+      t.string :api_key
       t.bigint :user_id
       t.bigint :account_id
       t.timestamps

data/lib/generators/action_agent/templates/create_active_agent_github_connections.rb.erb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+# GitHub connections: an owner's OAuth grant (Settings -> Integrations), the
+# repositories they made available to the workspace, and the checkout a
+# sandbox session boots its app runtime from. Emitted alongside the dashboard
+# tables on a fresh install, and on its own for an install that predates it.
+#
+# Table names follow ActionAgent.table_name_prefix, and JSON columns are
+# jsonb on PostgreSQL and json elsewhere, the same way as
+# create_active_agent_dashboard_tables.
+class CreateActiveAgentGithubConnections < ActiveRecord::Migration<%= migration_version %>
+  def change
+    prefix = ActionAgent.table_name_prefix
+
+    create_table "#{prefix}github_connections" do |t|
+      # The OAuth access token, encrypted at rest (text: ciphertext is longer
+      # than the token).
+      t.text :access_token, null: false
+      t.bigint :github_user_id, null: false
+      t.string :login, null: false
+      t.string :avatar_url
+      t.string :scopes
+      # The repositories the owner made available, as GitHub described them
+      # when they were chosen: full_name, id, private, default_branch.
+      t.column :repositories, json_type, **json_default([])
+      t.bigint :user_id
+      t.bigint :account_id
+      t.timestamps
+      t.index :account_id
+      t.index :user_id
+    end
+
+    # A sandbox booted from a checkout of one of those repositories, and the
+    # app runtime's MCP endpoint (and the bearer token it expects, encrypted)
+    # once the backend reports them.
+    change_table "#{prefix}sandbox_sessions" do |t|
+      t.string :repository
+      t.string :repository_ref
+      t.string :runtime_mcp_url
+      t.text :runtime_mcp_token
+    end
+  end
+
+  private
+
+  def json_type
+    @json_type ||= postgres? ? :jsonb : :json
+  end
+
+  # MySQL rejects a default on a JSON column outright, so the column is
+  # created without one there.
+  def json_default(value, null: nil)
+    return {} unless postgres?
+
+    null.nil? ? { default: value } : { default: value, null: null }
+  end
+
+  def postgres?
+    connection.adapter_name.to_s.downcase.include?("postgres")
+  end
+end

data/lib/tasks/claude_code.rake

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+namespace :action_agent do
+  namespace :claude_code do
+    # Earlier versions accepted a `claude setup-token` token (a Claude
+    # subscription credential) for the Claude Code connection. Anthropic does
+    # not let third-party products store those, and they are no longer used;
+    # this removes the ones still stored. Run it once after upgrading.
+    desc "Delete stored Claude Code connections holding a Claude subscription token (sk-ant-oat…), " \
+         "which are no longer used; their owners connect an Anthropic API key instead"
+    task purge_subscription_tokens: :environment do
+      count = ActionAgent::ProviderKey.purge_subscription_tokens!
+      puts "Deleted #{count} stored Claude subscription token(s)"
+    end
+  end
+end

data/lib/tasks/sandbox.rake

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+namespace :action_agent do
+  namespace :sandbox do
+    desc "Write this app's checkout sandbox runtime manifest ({mcp_path, mcp_token}) to " \
+         "$ACTION_AGENT_SANDBOX_MANIFEST, or print it"
+    task manifest: :environment do
+      manifest = JSON.generate(ActionAgent::SandboxManifest.generate)
+
+      if (path = ENV[ActionAgent::SandboxManifest::PATH_ENV].presence)
+        File.write(path, manifest)
+      else
+        puts manifest
+      end
+    rescue ActionAgent::SandboxManifest::Error => e
+      abort "action_agent:sandbox:manifest: #{e.message}"
+    end
+
+    desc "Expire sandbox sessions past their expiry and release what their backend holds " \
+         "(processes, containers). Schedule it, e.g. every few minutes."
+    task reap: :environment do
+      count = ActionAgent::SandboxCleanupJob.cleanup_expired!
+      puts "Expired #{count.to_i} sandbox session(s)"
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionagent
 version: !ruby/object:Gem::Version
-  version: 1.7.2
+  version: 1.8.1
 platform: ruby
 authors:
 - Justin Bowen
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-30 00:00:00.000000000 Z
+date: 2026-10-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activeagent
@@ -129,9 +129,11 @@ files:
 - app/controllers/action_agent/api/analytics_controller.rb
 - app/controllers/action_agent/api/api_keys_controller.rb
 - app/controllers/action_agent/api/base_controller.rb
+- app/controllers/action_agent/api/code_sessions_controller.rb
 - app/controllers/action_agent/api/dashboard_assistant_controller.rb
 - app/controllers/action_agent/api/evaluation_reports_controller.rb
 - app/controllers/action_agent/api/evaluations_controller.rb
+- app/controllers/action_agent/api/github_connections_controller.rb
 - app/controllers/action_agent/api/instance_tiers_controller.rb
 - app/controllers/action_agent/api/interaction_messages_controller.rb
 - app/controllers/action_agent/api/interactions_controller.rb
@@ -151,9 +153,13 @@ files:
 - app/controllers/action_agent/dashboard_controller.rb
 - app/controllers/action_agent/traces_controller.rb
 - app/controllers/concerns/action_agent/api/agent_serialization.rb
+- app/controllers/concerns/action_agent/api/evaluation_run_starting.rb
 - app/controllers/concerns/action_agent/api/ingest_authentication.rb
+- app/controllers/concerns/action_agent/api/mcp_dashboard_tools.rb
+- app/controllers/concerns/action_agent/api/run_sandbox.rb
 - app/jobs/action_agent/agent_execution_job.rb
 - app/jobs/action_agent/application_job.rb
+- app/jobs/action_agent/code_session_job.rb
 - app/jobs/action_agent/evaluation_run_job.rb
 - app/jobs/action_agent/process_telemetry_traces_job.rb
 - app/jobs/action_agent/sandbox_cleanup_job.rb
@@ -171,10 +177,12 @@ files:
 - app/models/action_agent/agent_version.rb
 - app/models/action_agent/api_key.rb
 - app/models/action_agent/application_record.rb
+- app/models/action_agent/code_session.rb
 - app/models/action_agent/evaluation.rb
 - app/models/action_agent/evaluation_run.rb
 - app/models/action_agent/evaluation_scenario.rb
 - app/models/action_agent/evaluation_scenario_result.rb
+- app/models/action_agent/github_connection.rb
 - app/models/action_agent/model_pricing.rb
 - app/models/action_agent/provider_key.rb
 - app/models/action_agent/recording_action.rb
@@ -190,6 +198,7 @@ files:
 - app/queries/action_agent/agent_executions.rb
 - app/queries/action_agent/metrics_report.rb
 - app/serializers/action_agent/agent_message_serializer.rb
+- app/serializers/action_agent/evaluation_serializer.rb
 - app/serializers/action_agent/interaction_preview.rb
 - app/serializers/action_agent/telemetry_trace_serializer.rb
 - app/serializers/action_agent/trace_interaction_serializer.rb
@@ -200,19 +209,30 @@ files:
 - app/services/action_agent/agent_sync.rb
 - app/services/action_agent/agent_tool_roster.rb
 - app/services/action_agent/agent_toolbox.rb
+- app/services/action_agent/claude_code_auth.rb
+- app/services/action_agent/codex_session_events.rb
 - app/services/action_agent/dashboard_assistant_service.rb
 - app/services/action_agent/evaluation_evidence.rb
 - app/services/action_agent/evaluation_report_import.rb
+- app/services/action_agent/evaluation_run_cost.rb
 - app/services/action_agent/evaluation_runner_service.rb
+- app/services/action_agent/evaluation_standing.rb
 - app/services/action_agent/evaluation_tool_resolver.rb
+- app/services/action_agent/github_client.rb
+- app/services/action_agent/local_sandbox_backend.rb
+- app/services/action_agent/local_sandbox_databases.rb
 - app/services/action_agent/mcp_catalog.rb
 - app/services/action_agent/mcp_client.rb
 - app/services/action_agent/mcp_recording_middleware.rb
 - app/services/action_agent/mcp_tool_dispatcher.rb
 - app/services/action_agent/mock_sandbox_backend.rb
+- app/services/action_agent/ollama_host_probe.rb
+- app/services/action_agent/payload_bounds.rb
 - app/services/action_agent/playwright_mcp_client.rb
+- app/services/action_agent/sandbox_manifest.rb
 - app/services/action_agent/sandbox_orchestrator.rb
 - app/services/action_agent/scenario_evaluation_runner.rb
+- app/services/action_agent/secret_scrubber.rb
 - app/services/action_agent/session_recording_service.rb
 - app/services/action_agent/tool_discovery.rb
 - app/views/action_agent/dashboard/index.html.erb
@@ -233,12 +253,18 @@ files:
 - lib/generators/action_agent/templates/action_agent.rb.erb
 - lib/generators/action_agent/templates/add_agent_id_to_active_agent_telemetry_traces.rb.erb
 - lib/generators/action_agent/templates/add_agent_releases.rb.erb
+- lib/generators/action_agent/templates/add_code_session_runner.rb.erb
 - lib/generators/action_agent/templates/add_evaluation_report_identity.rb.erb
+- lib/generators/action_agent/templates/add_provider_key_api_key.rb.erb
+- lib/generators/action_agent/templates/create_active_agent_code_sessions.rb.erb
 - lib/generators/action_agent/templates/create_active_agent_dashboard_tables.rb.erb
 - lib/generators/action_agent/templates/create_active_agent_evaluation_scenarios.rb.erb
+- lib/generators/action_agent/templates/create_active_agent_github_connections.rb.erb
 - lib/generators/action_agent/templates/create_active_agent_telemetry_traces.rb.erb
 - lib/generators/action_agent/templates/ensure_agent_release_columns.rb.erb
 - lib/tasks/action_agent.rake
+- lib/tasks/claude_code.rake
+- lib/tasks/sandbox.rake
 homepage: https://activeagents.ai
 licenses:
 - MIT