actionagent 1.7.2 → 1.8.1

data/app/models/action_agent/code_session.rb

@@ -0,0 +1,145 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  # A headless Claude Code session run inside an app_runtime sandbox's
+  # checkout: the prompt, the stream-json transcript as it arrived, the
+  # outcome Claude Code reported, and the diff the session left in the
+  # working tree.
+  #
+  # The transcript is scrubbed of the sandbox's secrets (its GitHub token and
+  # Claude Code credential) before it is stored, and bounded: long strings
+  # are truncated and events past MAX_EVENTS are counted rather than kept.
+  class CodeSession < ApplicationRecord
+    include Ownable
+    owned_by :user, :account
+
+    belongs_to :sandbox_session
+
+    enum :status, { queued: 0, running: 1, succeeded: 2, failed: 3, cancelled: 4 }
+
+    MAX_PROMPT_CHARACTERS = 20_000
+    MAX_EVENTS = 1_000
+    # Per string inside an event: tool results can be whole files.
+    MAX_EVENT_STRING = 4_000
+    MAX_DIFF_BYTES = 500_000
+    RUNNERS = %w[claude_code codex].freeze
+
+    validates :prompt, presence: true, length: { maximum: MAX_PROMPT_CHARACTERS }
+    validates :runner, inclusion: { in: RUNNERS }
+
+    scope :recent, -> { order(created_at: :desc) }
+
+    # JSON columns carry no default on MySQL or SQLite (see the migration).
+    def events
+      Array(super)
+    end
+
+    def finished?
+      succeeded? || failed? || cancelled?
+    end
+
+    # Whether an outcome and a diff may still be recorded for this session.
+    # finished_at is set once nothing more will be: by CodeSessionJob when it
+    # settles a session it ran (whatever the backend returned, raised or
+    # refused), or by the cancel of a session that never left the queue. A
+    # session cancelled while running is finished at once but settled only
+    # when its Claude Code has stopped, so its diff may still come, and its
+    # transcript still grow, until then.
+    def diff_pending?
+      finished_at.nil?
+    end
+
+    # The values that must never be stored: the checkout token and the
+    # Claude Code credential this session ran with.
+    def secrets
+      spec = sandbox_session.checkout_spec rescue nil
+      [ spec&.dig(:token), *sandbox_session.runtime_environment(runner: runner).values ].compact
+    end
+
+    # Appends one stream-json event, scrubbed and bounded. Past MAX_EVENTS
+    # only the count grows, so a runaway session cannot grow the row without
+    # limit.
+    def append_event!(event, secrets: self.secrets)
+      stored = truncate_strings(SecretScrubber.scrub(event.to_h, secrets))
+
+      with_lock do
+        list = events
+        if list.size < MAX_EVENTS
+          self.events = list + [ stored ]
+        else
+          self.dropped_events_count = dropped_events_count.to_i + 1
+        end
+        save!
+      end
+    end
+
+    # Records Claude Code's final "result" event.
+    def record_result!(event)
+      usage = event["usage"].is_a?(Hash) ? event["usage"] : {}
+
+      update!(
+        result: event["result"].to_s.presence && SecretScrubber.scrub(event["result"].to_s, secrets).truncate(MAX_EVENT_STRING * 4),
+        claude_session_id: runner == "claude_code" ? event["session_id"] : nil,
+        runner_session_id: event["session_id"],
+        num_turns: event["num_turns"],
+        duration_ms: event["duration_ms"],
+        total_cost_usd: event["total_cost_usd"],
+        input_tokens: usage["input_tokens"],
+        output_tokens: usage["output_tokens"]
+      )
+    end
+
+    def diff=(value)
+      text = SecretScrubber.scrub(value.to_s, secrets)
+      super(text.bytesize > MAX_DIFF_BYTES ? "#{text.byteslice(0, MAX_DIFF_BYTES).scrub}\n… diff truncated" : text)
+    end
+
+    def summary
+      {
+        id: id,
+        sandbox_session_id: sandbox_session.session_id,
+        status: status,
+        prompt: prompt,
+        model: model,
+        runner: runner,
+        result: result,
+        error_message: error_message,
+        num_turns: num_turns,
+        duration_ms: duration_ms,
+        total_cost_usd: total_cost_usd&.to_f,
+        input_tokens: input_tokens,
+        output_tokens: output_tokens,
+        event_count: events.size + dropped_events_count.to_i,
+        # What a client polls until: false once nothing about the session
+        # changes any more.
+        diff_pending: diff_pending?,
+        started_at: started_at&.iso8601,
+        finished_at: finished_at&.iso8601,
+        created_at: created_at&.iso8601
+      }
+    end
+
+    # The summary plus the transcript from event index +after+ onward (for
+    # incremental polling) and the diff once finished.
+    def details(after: 0)
+      after = after.to_i.clamp(0, events.size)
+      summary.merge(
+        events: events.drop(after),
+        events_offset: after,
+        dropped_events_count: dropped_events_count.to_i,
+        diff: finished? ? diff : nil
+      )
+    end
+
+    private
+
+    def truncate_strings(value)
+      case value
+      when String then value.length > MAX_EVENT_STRING ? "#{value[0, MAX_EVENT_STRING]}… (truncated)" : value
+      when Hash then value.to_h { |key, item| [ key, truncate_strings(item) ] }
+      when Array then value.map { |item| truncate_strings(item) }
+      else value
+      end
+    end
+  end
+end

data/app/models/action_agent/evaluation.rb

@@ -34,6 +34,20 @@ module ActionAgent
     validate :validate_criteria
 
     scope :recent, -> { order(updated_at: :desc) }
+    # Archived evaluations keep their runs but leave the index and its
+    # tiles unless asked for (see #archive!). The mark lives in the config
+    # JSON, so the filter reads it with each database's own JSON path.
+    scope :archived, -> { where("#{archived_at_sql} IS NOT NULL") }
+    scope :unarchived, -> { where("#{archived_at_sql} IS NULL") }
+
+    # SQL reading config["archived_at"] on the connected database.
+    def self.archived_at_sql
+      case connection.adapter_name.to_s.downcase
+      when /postgres/ then "#{quoted_table_name}.config ->> 'archived_at'"
+      when /mysql|trilogy/ then "JSON_UNQUOTE(JSON_EXTRACT(#{quoted_table_name}.config, '$.archived_at'))"
+      else "json_extract(#{quoted_table_name}.config, '$.archived_at')"
+      end
+    end
 
     # MySQL cannot give a JSON column a default, so a row inserted there
     # without `criteria` or `config` reads back nil. Both readers answer with
@@ -50,6 +64,56 @@ module ActionAgent
       evaluation_runs.order(created_at: :desc).first
     end
 
+    # The newest run that finished: the one the evaluation's pass rate
+    # describes. A newer run still pending, or one that failed, shows
+    # beside it and never in its place. Read from the loaded association
+    # when the index preloaded it.
+    def headline_run
+      if evaluation_runs.loaded?
+        evaluation_runs.select(&:complete?).max_by { |run| [ run.created_at, run.id ] }
+      else
+        evaluation_runs.complete.order(created_at: :desc, id: :desc).first
+      end
+    end
+
+    # --- archiving ---------------------------------------------------------
+    #
+    # An evaluation nobody maintains — its suite superseded, its agent
+    # retired — keeps its history but stops counting: the index leaves it
+    # out, and so do the pooled pass rate and the agent's scorecard. The
+    # mark is config["archived_at"]; a new run or a published report clears
+    # it, since either says the evaluation is alive after all.
+
+    def archived_at
+      value = config["archived_at"]
+      value.present? ? Time.zone.parse(value.to_s) : nil
+    rescue ArgumentError
+      nil
+    end
+
+    def archived?
+      config["archived_at"].present?
+    end
+
+    def archive!
+      update!(config: config.merge("archived_at" => Time.current.iso8601))
+    end
+
+    def unarchive!
+      return unless archived?
+
+      update!(config: config.except("archived_at"))
+    end
+
+    # Where this evaluation stands against the agent as it is now: whether
+    # its headline run scored the current version (EvaluationStanding).
+    # Memoized per instance; the index preloads what it needs.
+    def standing_info
+      @standing_info ||= EvaluationStanding.new(self)
+    end
+
+    attr_writer :standing_info
+
     def judge_defined?
       judge_kind == "judge_defined"
     end

data/app/models/action_agent/evaluation_run.rb

@@ -9,15 +9,29 @@ module ActionAgent
   class EvaluationRun < ApplicationRecord
     belongs_to :evaluation
     # The version of the evaluated agent this run scored, so a pass rate is
-    # a statement about a release rather than about "the agent".
+    # a statement about a release rather than about "the agent". A run the
+    # engine executes scored the agent as it is now; an imported run scored
+    # the publishing application's code, which only its report can name
+    # (EvaluationReportImport sets the version from `report.release`), so
+    # a release-less import stays unrecorded rather than claiming the
+    # dashboard's latest version.
     belongs_to :agent_version, optional: true
-    before_create { self.agent_version_id ||= evaluation&.agent&.latest_version&.id }
+    before_create { self.agent_version_id ||= evaluation&.agent&.latest_version&.id unless imported? }
+    # A run started on an archived evaluation brings it back: archiving says
+    # "no longer maintained", which a new run contradicts.
+    after_create { evaluation.unarchive! if evaluation&.archived? }
     has_many :scenario_results, class_name: "EvaluationScenarioResult", dependent: :destroy
 
     enum :status, { pending: 0, running: 1, complete: 2, failed: 3 }
 
     scope :recent, -> { order(created_at: :desc) }
 
+    # Whether this run was published by an application that ran it itself
+    # (EvaluationReportImport) rather than executed here.
+    def imported?
+      external_run_id.present?
+    end
+
     # Which scenarios and models a scenario run covered; empty for a
     # generation-sampling run.
     def selection
@@ -25,6 +39,19 @@ module ActionAgent
       value.is_a?(Hash) ? value : {}
     end
 
+    # The checkout sandbox a scenario run replayed against
+    # (ScenarioEvaluationRunner records it), as { "session_id", "server_key",
+    # "repository", "repository_ref" }; nil for a run against the agent's own
+    # servers only.
+    def sandbox
+      value = selection["sandbox"]
+      return value if value.is_a?(Hash)
+
+      # Still pending: run_later! recorded only what was asked for.
+      id = selection["sandbox_id"]
+      { "session_id" => id } if id.is_a?(String) && id.present?
+    end
+
     # The candidate models a scenario run compared, in the order they were
     # requested; empty for a generation-sampling run.
     def models
@@ -79,14 +106,37 @@ module ActionAgent
       (values.sum.to_f / values.size).round(3)
     end
 
-    # The judge's own spend on this run — calls, tokens, estimated cost and
-    # how many calls served each purpose — as the runner recorded it; nil
-    # for a run that never asked a judge.
-    def judge_usage
+    # The judge's own spend on this run as the engine's meter recorded it —
+    # calls, tokens, estimated cost and how many calls served each purpose
+    # — or nil for a run the engine did not judge (a rules-only run, or an
+    # imported one, whose judge the application ran).
+    def judge_usage_meter
       value = scores&.dig("_judge_usage")
       value.is_a?(Hash) ? value : nil
     end
 
+    # The judge's spend on this run from whatever recorded it: the meter,
+    # the publishing application's figures, or the judge traces priced
+    # (EvaluationRunCost). nil for a run no judge was asked about.
+    def judge_usage
+      cost_breakdown.judge_usage
+    end
+
+    # Every cost figure of this run — per result, per scenario, per model
+    # and in total — worked out once (EvaluationRunCost). A controller that
+    # lists runs preloads it (EvaluationRunCost.preload) and hands it in.
+    def cost_breakdown
+      @cost_breakdown ||= EvaluationRunCost.for(self)
+    end
+
+    attr_writer :cost_breakdown
+
+    # Forgets the breakdown, so a run whose results just changed is priced again.
+    def reload(*)
+      @cost_breakdown = nil
+      super
+    end
+
     # Per-model summaries of a generation-sampling run's cohorts, keyed by
     # model; empty for a scenario run or a run recorded before they were.
     def cohorts
@@ -94,59 +144,51 @@ module ActionAgent
       value.is_a?(Hash) ? value : {}
     end
 
+    # Per-model summaries of a scenario run, keyed by label, as the runner
+    # recorded them under "_models", each with its cost as it stands now:
+    # the effective "cost" over its results (reported, else estimated), the
+    # "priced", "reported" and "estimated" counts behind it, and the
+    # judge's "judge_cost" and "judge_calls" on them (EvaluationRunCost). A
+    # recorded summary no result maps to is served as recorded. Empty for a
+    # generation-sampling run.
+    def model_summaries
+      summaries = scores&.dig("_models")
+      return {} unless summaries.is_a?(Hash)
+
+      costed = cost_breakdown.by_label(summaries.keys)
+      summaries.to_h do |label, stats|
+        next [ label, stats ] unless stats.is_a?(Hash) && costed.key?(label)
+
+        [ label, stats.merge(costed[label]) ]
+      end
+    end
+
     # What the run spent, for display after it: the agent's side and the
     # judge's, kept apart because they answer different questions.
     #
     # The agent's side is the operating figure — what the interactions cost
-    # to serve. For a scenario run that is the replays' estimated cost,
-    # tokens and summed model time (`replays` of them); for a
-    # generation-sampling run it is the sampled generations' (`samples`),
-    # which were served before the run and cost it nothing. `per_interaction`
-    # is that cost spread over the interactions, the number a per-conversation
-    # budget is set against.
+    # to serve. For a scenario run that is its replays' cost, tokens and
+    # summed model time (`replays` of them); for a generation-sampling run
+    # it is the sampled generations' (`samples`), which were served before
+    # the run and cost it nothing.
+    #
+    # Every interaction with tokens is priced (EvaluationRunCost): `cost`
+    # sums the reported costs and, where none was reported, the estimates
+    # from tokens × model rates. `priced` and `unpriced` count the
+    # interactions either way, `reported` and `estimated` say how the priced
+    # ones were priced, and `cost_basis` sums that up as "reported",
+    # "estimated" or "mixed". `per_interaction` is the cost per priced
+    # interaction, the number a per-conversation budget is set against.
     #
     # `judge` is the evaluation's own overhead: the judge model's calls
     # (scoring, recommending, the verdict, authoring KPIs), which run
-    # agent-to-agent and offline. It is present only when a judge was asked.
+    # agent-to-agent and offline — from the engine's meter, the publishing
+    # application's figures or the judge traces, with `source` naming which
+    # and `run` the calls no result owns. `total` is the two sides together.
     #
     # Returns nil for a run that recorded nothing on either side.
     def usage
-      totals = scenario_results.pick(
-        Arel.sql("COUNT(*)"), Arel.sql("SUM(cost)"), Arel.sql("SUM(input_tokens)"),
-        Arel.sql("SUM(output_tokens)"), Arel.sql("SUM(duration_ms)")
-      )
-      replays = totals&.first.to_i
-      judge = judge_usage
-      runtime_ms = completed_at.present? ? ((completed_at - created_at) * 1000).round : nil
-
-      if replays.positive?
-        cost = totals[1]&.to_f
-        {
-          replays: replays,
-          cost: cost,
-          per_interaction: cost && (cost / replays).round(6),
-          input_tokens: totals[2].to_i,
-          output_tokens: totals[3].to_i,
-          model_time_ms: totals[4].to_i,
-          runtime_ms: runtime_ms,
-          judge: judge
-        }.compact
-      elsif cohorts.any?
-        samples = cohorts.values.sum { |cohort| cohort["samples"].to_i }
-        costs = cohorts.values.filter_map { |cohort| cohort["cost"] }
-        cost = costs.any? ? costs.sum.to_f.round(6) : nil
-        {
-          samples: samples,
-          cost: cost,
-          per_interaction: cost && samples.positive? ? (cost / samples).round(6) : nil,
-          input_tokens: cohorts.values.sum { |cohort| cohort["input_tokens"].to_i },
-          output_tokens: cohorts.values.sum { |cohort| cohort["output_tokens"].to_i },
-          runtime_ms: runtime_ms,
-          judge: judge
-        }.compact
-      elsif judge
-        { runtime_ms: runtime_ms, judge: judge }.compact
-      end
+      cost_breakdown.usage
     end
 
     # Route templates for the report's fix item actions, relative to the
@@ -181,10 +223,21 @@ module ActionAgent
     # the suite panel does. Raises ActiveRecord::RecordNotFound via the
     # caller for a run of a generation-sampling evaluation, which has no
     # scenario results to report on.
-    def to_report(links: report_links)
+    #
+    # With `estimate` (the default) each replay carries its effective cost
+    # and how it was priced (EvaluationRunCost), and the report is told the
+    # judge's run-level spend, so the page shows every cost the dashboard
+    # does. `estimate: false` rebuilds the report from what was recorded
+    # alone — the import summarizes a published run that way, so the
+    # summaries it stores stay the application's own figures.
+    #
+    # The engine runs against every activeagent since 1.4, so the report
+    # kwargs that arrived later are passed only when Report.new takes them.
+    def to_report(links: report_links, estimate: true)
       rows = scenario_results.includes(:scenario).sort_by do |row|
         [ row.evaluated_scenario["position"].to_i, row.evaluation_scenario_id, row.model ]
       end
+      breakdown = cost_breakdown if estimate
       selected = selected_specs
       specs = {}
       results = rows.map do |row|
@@ -197,28 +250,63 @@ module ActionAgent
           replay: ActiveAgent::Evals::Replay.new(
             answer: row.output, tool_calls: Array(row.tool_calls), duration_ms: row.duration_ms,
             input_tokens: row.input_tokens, output_tokens: row.output_tokens,
-            cost: row.cost&.to_f, error: row.error_message, metadata: row.replay_metadata
+            cost: breakdown ? breakdown.result(row)["cost"] : row.cost&.to_f, error: row.error_message,
+            metadata: replay_metadata_for(row, breakdown)
           ),
           scores: row.scores.to_h, score: row.score, status: row.status,
           diagnosis: row.evaluation_diagnosis.presence
         )
       end
 
-      ActiveAgent::Evals::Report.new(
+      kwargs = {
         results: results,
         models: (selected.values & specs.values) + (specs.values - selected.values),
         metadata: {
           "evaluation" => evaluation.name,
           "agent" => evaluation.agent&.name,
           "run" => id,
-          "finished" => completed_at&.iso8601
+          "finished" => completed_at&.iso8601,
+          "sandbox" => sandbox_label
         }.compact.merge(report_metadata),
         verdict: recorded_verdict,
         judge_label: judge_label,
         tool_resolver: EvaluationToolResolver.new(evaluation.agent),
         agent_name: evaluation.agent&.name,
         links: links
-      )
+      }
+      kwargs[:judge_usage] = breakdown.judge_usage_run if breakdown && self.class.report_accepts?(:judge_usage)
+      kwargs[:release] = release_summary if release_summary && self.class.report_accepts?(:release)
+      self.class.report_class.new(**kwargs)
+    end
+
+    # The framework's Report, as installed.
+    def self.report_class
+      ActiveAgent::Evals::Report
+    end
+
+    # Whether the installed framework's Report.new declares +keyword+.
+    def self.report_accepts?(keyword)
+      report_class.instance_method(:initialize).parameters.any? { |type, name| name == keyword && %i[key keyreq].include?(type) }
+    end
+
+    # The release this run scored, as the report names it — `{ "digest",
+    # "revision", "label" }` — or nil for a run pinned to a dashboard edit
+    # or to no version.
+    def release_summary
+      version = agent_version
+      return nil unless version&.release?
+
+      { "digest" => version.release_digest, "revision" => version.revision, "label" => "v#{version.version_number}" }.compact
+    end
+
+    # The agent version this run scored, for the run's JSON: `{ id, number,
+    # release_digest, revision, release }`, or nil when none was recorded.
+    def agent_version_summary
+      version = agent_version
+      return nil unless version
+
+      { id: version.id, number: version.version_number, release_digest: version.release_digest,
+        revision: version.revision, release: version.release? }
     end
 
     private
@@ -226,6 +314,30 @@ module ActionAgent
     ModelSpec = ActiveAgent::Evals::ModelSpec
     private_constant :ModelSpec
 
+    # The replay metadata the rebuilt report reads a result's costs from:
+    # what the result recorded, the judge usage the application reported
+    # for it, and — when estimating — how its cost was priced.
+    def replay_metadata_for(row, breakdown)
+      metadata = row.replay_metadata.dup
+      reported_judge = row.diagnosis.is_a?(Hash) ? row.diagnosis["_judge_usage"] : nil
+      metadata["judge_usage"] = reported_judge if reported_judge.is_a?(Hash)
+      return metadata unless breakdown
+
+      entry = breakdown.result(row)
+      metadata["cost_source"] = entry["cost_source"]
+      metadata["cost_rate"] = entry["cost_rate"] if entry["cost_rate"]
+      metadata["judge_usage"] = entry["judge_usage"] if entry["judge_usage"]
+      metadata
+    end
+
+    # How the report's header names the sandbox: its checkout and session.
+    def sandbox_label
+      return nil unless sandbox
+
+      checkout = [ sandbox["repository"], sandbox["repository_ref"] ].compact_blank.join("@")
+      [ checkout.presence, "sandbox #{sandbox["session_id"].to_s.first(8)}" ].compact.join(" · ")
+    end
+
     # The candidate specs the run was asked to compare, keyed by
     # [provider, model] in the order requested. ScenarioEvaluationRunner
     # persists each ModelSpec#to_h in `selection`, and it is that label —

data/app/models/action_agent/evaluation_scenario_result.rb

@@ -44,8 +44,11 @@ module ActionAgent
       value.is_a?(Hash) ? value : {}
     end
 
+    # The diagnosis as the dashboard shows it: without the storage keys —
+    # the replay metadata, the scenario snapshot and the judge usage the
+    # publishing application reported (served as `judge_usage` instead).
     def evaluation_diagnosis
-      (diagnosis || {}).except("_replay_metadata", "_scenario_snapshot")
+      (diagnosis || {}).except("_replay_metadata", "_scenario_snapshot", "_judge_usage")
     end
 
     # A catalog can be refreshed without changing what an earlier run asked
@@ -55,7 +58,12 @@ module ActionAgent
       snapshot.is_a?(Hash) ? snapshot : scenario.as_json_summary.stringify_keys
     end
 
-    def as_json_summary
+    # The result for the JSON API. Its cost is the effective one — reported,
+    # else estimated — with `reported_cost`, `cost_source`, `cost_rate` and
+    # the judge's `judge_usage` on it (EvaluationRunCost). A caller listing
+    # a run's results hands in the run's breakdown so nothing is priced per row.
+    def as_json_summary(costs: nil)
+      costs ||= evaluation_run.cost_breakdown.result(self)
       {
         id: id,
         scenario_id: evaluation_scenario_id,
@@ -73,7 +81,11 @@ module ActionAgent
         duration_ms: duration_ms,
         input_tokens: input_tokens,
         output_tokens: output_tokens,
-        cost: cost&.to_f,
+        cost: costs["cost"],
+        reported_cost: costs["reported_cost"],
+        cost_source: costs["cost_source"],
+        cost_rate: costs["cost_rate"],
+        judge_usage: costs["judge_usage"],
         fault: fault,
         recommendation: recommendation,
         diagnosis: evaluation_diagnosis,

data/app/models/action_agent/github_connection.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  # An owner's GitHub OAuth grant (Settings -> Integrations) and the
+  # repositories they made available to the workspace.
+  #
+  # The access token is encrypted at rest like a provider key and never
+  # rendered back to the client. +repositories+ holds only what GitHub
+  # itself listed for this token when the owner chose them (see
+  # Api::GithubConnectionsController#update), so a checkout sandbox can
+  # trust a name found here without asking GitHub again.
+  class GithubConnection < ApplicationRecord
+    include Ownable
+    owned_by :account, :user
+
+    encrypts :access_token if ActionAgent.encrypt_credentials
+
+    validates :access_token, :github_user_id, :login, presence: true
+    # One connection per owner; which column that means depends on the
+    # configured mode, so it is checked at validation time.
+    validate :unique_within_owner
+
+    # JSON columns carry no default on MySQL or SQLite (see the migration), so
+    # an unset column reads as nil.
+    def repositories
+      Array(super)
+    end
+
+    def repository_names
+      repositories.map { |repo| repo["full_name"] }
+    end
+
+    def repository(full_name)
+      repositories.find { |repo| repo["full_name"].casecmp?(full_name.to_s) }
+    end
+
+    def client
+      GithubClient.new(access_token)
+    end
+
+    # The checkout a sandbox backend clones: repository, ref, and an
+    # authenticated HTTPS clone URL. Carries the token — hand it to a backend,
+    # never to a response.
+    def checkout_spec(full_name, ref: nil)
+      repo = repository(full_name) or raise ArgumentError, "#{full_name} is not an available repository"
+
+      {
+        repository: repo["full_name"],
+        ref: ref.presence || repo["default_branch"],
+        clone_url: "https://github.com/#{repo["full_name"]}.git",
+        username: "x-access-token",
+        token: access_token
+      }
+    end
+
+    def as_summary
+      {
+        login: login,
+        avatar_url: avatar_url,
+        scopes: scopes.to_s.split(/[\s,]+/).reject(&:blank?),
+        repositories: repositories,
+        connected_at: created_at&.iso8601,
+        updated_at: updated_at&.iso8601
+      }
+    end
+
+    private
+
+    def unique_within_owner
+      siblings = self.class.for_owner(owner)
+      siblings = siblings.where.not(id: id) if persisted?
+      errors.add(:base, "GitHub is already connected") if siblings.exists?
+    end
+  end
+end