actionagent 1.8.0 → 1.9.0

data/app/services/action_agent/browser_sidecar.rb

@@ -0,0 +1,213 @@
+# frozen_string_literal: true
+
+require "json"
+require "open3"
+
+module ActionAgent
+  # Used to install, find and check the browser sidecar the :local sandbox
+  # backend runs: the @activeagents/browser-sidecar npm package, versioned
+  # with this engine, and the Chromium it drives. Both live under the local
+  # sandbox root:
+  #
+  #   .browser/
+  #     node_modules/   the package and its dependencies
+  #     browsers/       Chromium (PLAYWRIGHT_BROWSERS_PATH)
+  #
+  # ActionAgent.browser_sidecar_path names a checkout of the package to run
+  # instead, for working on the sidecar; its version is not checked.
+  #
+  # Nothing here downloads anything except #install!: a start with the
+  # sidecar or Chromium missing is refused with the command that installs
+  # them (#refusal).
+  class BrowserSidecar
+    PACKAGE = "@activeagents/browser-sidecar"
+    ENTRYPOINT = "bin/browser-sidecar.mjs"
+    MINIMUM_NODE = Gem::Version.new("20")
+    INSTALL_COMMAND = "bin/rails action_agent:browser:install"
+    CHECK_TIMEOUT = 30
+    INSTALL_TIMEOUT = 900
+
+    class Error < StandardError; end
+
+    # One thing a browser start needs. +fix+ says how to get it when it is
+    # not +ok+.
+    Check = Struct.new(:name, :ok, :detail, :fix, keyword_init: true) do
+      def message
+        ok ? detail : "#{detail}. #{fix}"
+      end
+    end
+
+    class << self
+      # @return [Pathname]
+      def root
+        ActionAgent.local_sandbox_root.join(".browser")
+      end
+
+      # Where Chromium is installed and looked for.
+      # @return [Pathname]
+      def browsers_path
+        root.join("browsers")
+      end
+
+      # The configured checkout, or nil to run the installed package.
+      # @return [Pathname, nil]
+      def checkout
+        path = ActionAgent.browser_sidecar_path.presence
+        path && Pathname.new(path.to_s).expand_path
+      end
+
+      # @return [Pathname]
+      def package_dir
+        checkout || root.join("node_modules", *PACKAGE.split("/"))
+      end
+
+      # The environment the sidecar runs with, on top of a sandbox's
+      # sanitized one.
+      # @return [Hash{String => String}]
+      def environment
+        { "PLAYWRIGHT_BROWSERS_PATH" => browsers_path.to_s }
+      end
+
+      # The command line that runs the sidecar with +args+.
+      # @return [Array<String>]
+      def command(*args)
+        [ ActionAgent.node_command.to_s, package_dir.join(ENTRYPOINT).to_s, *args ]
+      end
+
+      # Whether a sidecar reporting +version+ may run: the engine's own
+      # version, or any version from a configured checkout.
+      def acceptable_version?(version)
+        checkout.present? || version == ActionAgent::VERSION
+      end
+
+      # Node, the sidecar and Chromium, each checked. The doctor task prints
+      # these; a browser start refuses with the first that is not ok.
+      #
+      # @return [Array<Check>]
+      def checks
+        node = node_check
+        return [ node ] unless node.ok
+
+        sidecar, report = sidecar_check
+        return [ node, sidecar ] unless report
+
+        [ node, sidecar, chromium_check(report) ]
+      end
+
+      # Why a browser cannot start on this machine, or nil when it can.
+      # @return [String, nil]
+      def refusal
+        checks.find { |check| !check.ok }&.message
+      end
+
+      # Installs the sidecar (npm ci in a checkout, else the package at the
+      # engine's version under #root) and its Chromium, writing their output
+      # to +io+.
+      #
+      # @raise [Error] when a step fails
+      def install!(io = $stdout)
+        if checkout
+          run!(io, [ ActionAgent.npm_command.to_s, "ci" ], chdir: checkout)
+        else
+          FileUtils.mkdir_p(root)
+          manifest = root.join("package.json")
+          manifest.write(JSON.pretty_generate({ "private" => true, "description" => "The dashboard's browser sidecar" })) unless manifest.exist?
+          run!(io, [ ActionAgent.npm_command.to_s, "install", "--no-audit", "--no-fund", "--save-exact", "#{PACKAGE}@#{ActionAgent::VERSION}" ],
+            chdir: root)
+        end
+        run!(io, command("install-browser"), chdir: checkout || root)
+      end
+
+      private
+
+      def node_check
+        output, status = capture([ ActionAgent.node_command.to_s, "--version" ])
+        version = output.to_s[/\Av?(\d+\.\d+\.\d+)/, 1]
+        if status&.success? && version && Gem::Version.new(version) >= MINIMUM_NODE
+          return Check.new(name: "node", ok: true, detail: "Node.js #{version}")
+        end
+
+        Check.new(
+          name: "node", ok: false,
+          detail: version ? "Node.js #{version} is older than #{MINIMUM_NODE}" : "Node.js was not found (#{ActionAgent.node_command})",
+          fix: "Install Node.js #{MINIMUM_NODE} or later, or set ActionAgent.node_command"
+        )
+      end
+
+      # The sidecar check, and what its `check` command reported (nil when
+      # it could not run).
+      def sidecar_check
+        unless package_dir.join(ENTRYPOINT).file?
+          return [ Check.new(name: "sidecar", ok: false, detail: "The browser sidecar is not installed (#{package_dir})",
+            fix: "Run #{INSTALL_COMMAND}"), nil ]
+        end
+
+        output, status = capture(command("check"))
+        report = status&.success? ? parse_report(output) : nil
+        unless report
+          return [ Check.new(name: "sidecar", ok: false, detail: "The browser sidecar did not run: #{output.to_s.strip.lines.last&.strip}",
+            fix: "Run #{INSTALL_COMMAND}"), nil ]
+        end
+
+        version = report["version"].to_s
+        unless acceptable_version?(version)
+          return [ Check.new(name: "sidecar", ok: false,
+            detail: "The browser sidecar is version #{version}, and this dashboard needs #{ActionAgent::VERSION}",
+            fix: "Run #{INSTALL_COMMAND}"), report ]
+        end
+
+        [ Check.new(name: "sidecar", ok: true, detail: "Browser sidecar #{version}#{" (#{checkout})" if checkout}"), report ]
+      end
+
+      def chromium_check(report)
+        chromium = report["chromium"].is_a?(Hash) ? report["chromium"] : {}
+        return Check.new(name: "chromium", ok: true, detail: "Chromium at #{chromium["executable"]}") if chromium["installed"]
+
+        Check.new(name: "chromium", ok: false, detail: "Chromium is not installed (#{browsers_path})", fix: "Run #{INSTALL_COMMAND}")
+      end
+
+      def parse_report(output)
+        report = JSON.parse(output.to_s.lines.last.to_s)
+        report.is_a?(Hash) ? report : nil
+      rescue JSON::ParserError
+        nil
+      end
+
+      def process_environment
+        LocalSandboxBackend.sanitized_environment.merge(environment)
+      end
+
+      # Runs +argv+ with output captured, for at most CHECK_TIMEOUT seconds.
+      # Returns the output and the exit status, nil when it could not run.
+      def capture(argv)
+        Open3.popen2e(process_environment, *argv, unsetenv_others: true, pgroup: true) do |stdin, output, waiter|
+          stdin.close
+          reader = Thread.new { output.read }
+          unless waiter.join(CHECK_TIMEOUT)
+            Process.kill("KILL", -waiter.pid)
+            return [ "timed out after #{CHECK_TIMEOUT}s", nil ]
+          end
+          [ reader.value, waiter.value ]
+        end
+      rescue SystemCallError => e
+        [ e.message, nil ]
+      end
+
+      def run!(io, argv, chdir:)
+        io.puts("$ #{argv.join(' ')}")
+        Open3.popen2e(process_environment, *argv, chdir: chdir.to_s, unsetenv_others: true, pgroup: true) do |stdin, output, waiter|
+          stdin.close
+          reader = Thread.new { output.each_line { |line| io.write(line) } }
+          unless waiter.join(INSTALL_TIMEOUT)
+            Process.kill("KILL", -waiter.pid)
+            raise Error, "#{argv.first} did not finish within #{INSTALL_TIMEOUT}s"
+          end
+          reader.join
+          raise Error, "#{argv.join(' ')} failed (#{waiter.value.exitstatus || waiter.value.termsig})" unless waiter.value.success?
+        end
+      rescue SystemCallError => e
+        raise Error, "Could not run #{argv.first}: #{e.message}"
+      end
+    end
+  end
+end

data/app/services/action_agent/browser_sign_in.rb

@@ -0,0 +1,163 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  # Used to sign a project's sandbox browser in to the app with a sign_in
+  # ProjectSecret, from the Rails process, so the credentials never reach a
+  # model: they are typed into the form by SandboxBrowserDriver and appear in
+  # no tool argument, tool result, log line, span or recorded action. The
+  # browser's own recording masks what is typed.
+  #
+  # The form is found on the secret's login_url: the password field, then the
+  # login field and the submit button near it, unless the secret names them
+  # with CSS selectors. The browser is signed in once the page it shows has
+  # no password field. Otherwise the password field is emptied, so a later
+  # page snapshot cannot show it.
+  class BrowserSignIn
+    # The outcome, as the explorer's sign_in tool and the test account step
+    # report it:
+    #
+    #   signed_in    the browser left the login form
+    #   failed       it still shows a password field, as after a wrong
+    #                password
+    #   unsupported  the login page has no password field, as with sign-in
+    #                through another site (OAuth or SSO)
+    #   error        the browser could not be driven
+    Result = Struct.new(:status, :message, keyword_init: true) do
+      def signed_in?
+        status == "signed_in"
+      end
+
+      def to_h
+        { status: status, signed_in: signed_in?, message: message }
+      end
+    end
+
+    MESSAGES = {
+      "signed_in" => "Signed in: the browser left the login form.",
+      "failed" => "The browser still shows the login form after submitting it. Check the login and password.",
+      "unsupported" => "The login page has no password field, so the app's sign-in (OAuth or SSO only) is not " \
+                       "supported in the sandbox.",
+      "error" => "The sandbox's browser could not be driven to sign in."
+    }.freeze
+
+    PASSWORD_TARGET = '[data-aa-sign-in="password"]'
+    LOGIN_TARGET = '[data-aa-sign-in="login"]'
+    SUBMIT_TARGET = '[data-aa-sign-in="submit"]'
+    LOGIN_CANDIDATES = 'input[type="email"], input[autocomplete="username"], input[autocomplete="email"], ' \
+                       'input[name*="email" i], input[name*="login" i], input[name*="user" i], input[type="text"]'
+    # How long a sign-in that has not left the login form yet is given before
+    # it counts as failed.
+    SETTLE_SECONDS = 2
+    VISIBLE = "(el) => !!(el && (el.offsetWidth || el.offsetHeight || el.getClientRects().length))"
+    CLEAR_PASSWORDS = "() => { document.querySelectorAll('input[type=\"password\"]').forEach((el) => { el.value = ''; }); return true; }"
+
+    # @param sandbox [SandboxSession] with its browser running
+    # @param secret [ProjectSecret] a sign_in secret
+    # @return [Result]
+    def self.call(sandbox, secret, driver: nil)
+      new(sandbox, secret, driver).call
+    end
+
+    def initialize(sandbox, secret, driver)
+      @sandbox = sandbox
+      @secret = secret
+      @driver = driver
+    end
+
+    def call
+      credentials = @secret.sign_in_credentials
+      return result("failed") if credentials["password"].blank?
+
+      driver.open(credentials["login_url"])
+      marks = driver.evaluate(mark_fields(credentials))
+      return result("unsupported") unless marks.is_a?(Hash) && marks["password"] == true
+
+      login_path = marks["path"]
+      driver.type(LOGIN_TARGET, credentials["login"]) if marks["login"] == true && credentials["login"].present?
+      if marks["submit"] == true
+        driver.type(PASSWORD_TARGET, credentials["password"])
+        driver.click(SUBMIT_TARGET)
+      else
+        driver.type(PASSWORD_TARGET, credentials["password"], submit: true)
+      end
+
+      return result("signed_in") if left_form?(credentials, login_path)
+
+      driver.evaluate(CLEAR_PASSWORDS)
+      result("failed")
+    rescue SandboxBrowserDriver::Error => e
+      Rails.logger.warn("[ActionAgent] sign-in in sandbox #{@sandbox.session_id} failed: #{e.message}")
+      clear_quietly
+      result("error")
+    end
+
+    private
+
+    def driver
+      @driver ||= SandboxBrowserDriver.new(@sandbox)
+    end
+
+    def result(status)
+      Result.new(status: status, message: MESSAGES.fetch(status))
+    end
+
+    # Whether the browser shows a page without a password field: at once on
+    # a page other than +login_path+, or on any page after SETTLE_SECONDS,
+    # for an app that redirects late or whose signed-in page shares the
+    # login page's path. A failure the app renders on another path, such as
+    # the form's POST path, still shows the field.
+    def left_form?(credentials, login_path)
+      state = page_state(credentials)
+      return true if state && state["path"] != login_path && !state["passwordField"]
+
+      driver.wait(SETTLE_SECONDS)
+      state = page_state(credentials)
+      state.present? && !state["passwordField"]
+    end
+
+    # { "path", "passwordField" }: the page's path, and whether it shows the
+    # secret's password field or any visible one. Nil when the page does not
+    # answer.
+    def page_state(credentials)
+      state = driver.evaluate(<<~JS.squish)
+        () => {
+          const visible = #{VISIBLE};
+          let named = null;
+          try { named = #{credentials['password_field'].to_json} ? document.querySelector(#{credentials['password_field'].to_json}) : null; } catch (e) {}
+          const field = named || [...document.querySelectorAll('input[type="password"]')].find(visible);
+          return { path: location.pathname, passwordField: visible(field) };
+        }
+      JS
+      state.is_a?(Hash) ? state : nil
+    end
+
+    def clear_quietly
+      @driver&.evaluate(CLEAR_PASSWORDS)
+    rescue SandboxBrowserDriver::Error
+      nil
+    end
+
+    # The page function that finds the sign-in form and marks its fields
+    # with data-aa-sign-in, answering which it found. Selectors from the
+    # secret are passed as JSON string literals.
+    def mark_fields(credentials)
+      password, login, submit = credentials.values_at("password_field", "login_field", "submit_field").map(&:to_json)
+      <<~JS.squish
+        () => {
+          const visible = #{VISIBLE};
+          const pick = (selector) => { try { return selector ? document.querySelector(selector) : null; } catch (e) { return null; } };
+          document.querySelectorAll('[data-aa-sign-in]').forEach((el) => el.removeAttribute('data-aa-sign-in'));
+          const password = pick(#{password}) || [...document.querySelectorAll('input[type="password"]')].find(visible);
+          if (!password) return { password: false, path: location.pathname };
+          const scope = password.form || document;
+          const login = pick(#{login}) || [...scope.querySelectorAll(#{LOGIN_CANDIDATES.to_json})].find((el) => el !== password && visible(el));
+          const submit = pick(#{submit}) || scope.querySelector('button[type="submit"], input[type="submit"]') || scope.querySelector('button:not([type])');
+          password.setAttribute('data-aa-sign-in', 'password');
+          if (login) login.setAttribute('data-aa-sign-in', 'login');
+          if (submit) submit.setAttribute('data-aa-sign-in', 'submit');
+          return { password: true, login: !!login, submit: !!submit, path: location.pathname };
+        }
+      JS
+    end
+  end
+end

data/app/services/action_agent/browser_tool_redaction.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  # Masks what a browser tool call typed: the `text` of `browser_type` and
+  # `browser_press_sequentially`, the `promptText` of `browser_handle_dialog`
+  # and each field `value` of `browser_fill_form`. MCPRecordingMiddleware applies it before an agent's
+  # browser action is stored, and SessionTimeline before a tool call is
+  # shown.
+  #
+  # Masking is per call. A value one call typed is masked in that call's
+  # arguments and result, but not in another call's result that shows it,
+  # such as a later snapshot of the filled field.
+  module BrowserToolRedaction
+    MASK = "[REDACTED]"
+    # The argument that holds what each single-value typing tool typed.
+    TYPED_ARGUMENTS = {
+      "browser_type" => "text", "browser_press_sequentially" => "text", "browser_handle_dialog" => "promptText"
+    }.freeze
+    TYPING_TOOLS = [ *TYPED_ARGUMENTS.keys, "browser_fill_form" ].freeze
+    # Shorter typed values are masked in the arguments but not searched for
+    # in other text, where they would mask unrelated characters.
+    MIN_SEARCHED_LENGTH = 3
+
+    module_function
+
+    def typing_tool?(tool_name)
+      TYPING_TOOLS.include?(tool_name.to_s)
+    end
+
+    # Returns +arguments+ with the typed values masked, in the form given: a
+    # Hash, or JSON text. Arguments of a typing tool that cannot be read as a
+    # Hash, such as JSON cut off mid-string, are masked whole. Other tools'
+    # arguments are returned unchanged.
+    def redact_arguments(tool_name, arguments)
+      return arguments unless typing_tool?(tool_name)
+
+      parsed = parse(arguments)
+      return MASK unless parsed.is_a?(Hash)
+
+      typed = TYPED_ARGUMENTS[tool_name.to_s]
+      masked =
+        if typed
+          parsed.key?(typed) ? parsed.merge(typed => MASK) : parsed
+        else
+          parsed.merge("fields" => Array(parsed["fields"]).map { |field| mask_field(field) })
+        end
+      arguments.is_a?(String) ? masked.to_json : masked
+    end
+
+    # Returns +text+, such as a tool result, with the values the call typed
+    # masked. A typing tool's text is masked whole when its +arguments+
+    # cannot be read. Other tools' text is returned unchanged.
+    def redact_text(tool_name, text, arguments)
+      return text unless typing_tool?(tool_name) && text.is_a?(String)
+
+      parsed = parse(arguments)
+      return MASK unless parsed.is_a?(Hash)
+
+      typed_values(tool_name, parsed)
+        .select { |value| value.length >= MIN_SEARCHED_LENGTH }
+        .sort_by { |value| -value.length }
+        .reduce(text) { |masked, value| masked.gsub(value, MASK) }
+    end
+
+    # The values a typing tool call typed, from its parsed arguments.
+    def typed_values(tool_name, parsed)
+      typed = TYPED_ARGUMENTS[tool_name.to_s]
+      values = typed ? [ parsed[typed] ] : Array(parsed["fields"]).map { |field| field["value"] if field.is_a?(Hash) }
+      values.compact.map(&:to_s).reject(&:empty?)
+    end
+
+    def mask_field(field)
+      return field unless field.is_a?(Hash)
+
+      field = field.deep_stringify_keys
+      field.key?("value") ? field.merge("value" => MASK) : field
+    end
+
+    # +arguments+ as a string-keyed Hash: a Hash as given, JSON text parsed.
+    # Anything else, or JSON that does not parse, is returned as nil.
+    def parse(arguments)
+      case arguments
+      when Hash then arguments.deep_stringify_keys
+      when String
+        parsed = JSON.parse(arguments)
+        parsed.is_a?(Hash) ? parsed : nil
+      end
+    rescue JSON::ParserError
+      nil
+    end
+  end
+end

data/app/services/action_agent/claude_code_auth.rb

@@ -14,8 +14,8 @@ module ActionAgent
   #              LocalSandboxBackend.claude_login_status). The dashboard never
   #              sees that credential.
   #
-  # Anthropic does not let third-party products store or route requests
-  # through Claude.ai subscription credentials, so there is no third mode:
+  # :sandbox_login is the user's login inside the unmodified CLI. Only the
+  # CLI holds its credential; the dashboard relays a one-use login code.
   # https://code.claude.com/docs/en/legal-and-compliance.md
   module ClaudeCodeAuth
     module_function
@@ -29,6 +29,12 @@ module ActionAgent
       mode == "local_login"
     end
 
+    def sandbox_login?
+      mode == "sandbox_login"
+    end
+
+    LOGIN_VERBS = %i[start_claude_login submit_claude_login_code claude_login_status claude_logout].freeze
+
     # Why +orchestrator+'s backend cannot run Claude Code sessions with the
     # configured authentication, or nil. A machine's own login is the
     # dashboard user's, so only a backend running sessions as that user, on
@@ -36,6 +42,15 @@ module ActionAgent
     # find no login or need it copied there, which is what this mode exists
     # to never do.
     def backend_refusal(orchestrator)
+      if sandbox_login?
+        unless LOGIN_VERBS.all? { |verb| orchestrator.supports?(verb) }
+          return "The #{orchestrator.backend_name} backend does not implement sandbox Claude login (#{LOGIN_VERBS.join(', ')})"
+        end
+        unless orchestrator.local? || ActionAgent.claude_code_hosted_login_enabled
+          return "Hosted Claude subscription login is disabled; the operator must review the hosting requirements and enable it explicitly"
+        end
+        return
+      end
       return unless local_login?
       return if orchestrator.local?
 
@@ -53,12 +68,15 @@ module ActionAgent
     # +provider_keys+: booleans and the login's method, never a credential.
     #
     # @return [Hash] { mode:, connected:, login: } (login for :local_login only)
-    def status(provider_keys)
+    def status(provider_keys, sandboxes: [], user_id: nil)
       if local_login?
         # Only the :local backend uses the login, and no other one needs
         # this machine's CLI asked about it.
         login = local_backend? ? LocalSandboxBackend.claude_login_status : LocalSandboxBackend::LOGGED_OUT
         { mode: mode, connected: login[:logged_in], login: login.slice(:logged_in, :auth_method) }
+      elsif sandbox_login?
+        sessions = Array(sandboxes).map { |sandbox| sandbox_status(sandbox, user_id: user_id) }
+        { mode: mode, connected: api_key_connected?(provider_keys) || sessions.any? { |row| row[:logged_in] }, sandboxes: sessions }
       else
         { mode: mode, connected: api_key_connected?(provider_keys) }
       end
@@ -73,7 +91,15 @@ module ActionAgent
 
     # Why a Claude Code session cannot start in +sandbox+ for want of
     # credentials, or nil.
-    def credential_refusal(sandbox)
+    def credential_refusal(sandbox, user_id: nil)
+      if sandbox_login?
+        if (refusal = login_owner_refusal(sandbox, user_id: user_id))
+          return refusal
+        end
+        return if credential_mode(sandbox, user_id: user_id)
+
+        return "Sign in with your own Claude subscription in this sandbox, or connect an Anthropic API key"
+      end
       if local_login?
         return if LocalSandboxBackend.claude_login_status[:logged_in]
 
@@ -82,5 +108,45 @@ module ActionAgent
         "Claude Code is not connected: connect an Anthropic API key in Settings -> Integrations first"
       end
     end
+
+    # Why +user_id+ may run nothing in +sandbox+ under :sandbox_login, or nil.
+    # Every session runs as the same OS user beside the signed-in member's
+    # CLAUDE_CONFIG_DIR, so while one member's login is there no one else's
+    # session, on any runner or credential, may run in that checkout.
+    def login_owner_refusal(sandbox, user_id: nil)
+      return unless sandbox_login?
+      owner = sandbox.try(:claude_login_user_id)
+      return if owner.nil? || (user_id.present? && owner == user_id)
+
+      "Another member is signed in to Claude Code in this sandbox; start your own sandbox"
+    end
+
+    def credential_mode(sandbox, user_id: nil)
+      return mode unless sandbox_login?
+      return if login_owner_refusal(sandbox, user_id: user_id)
+      if user_id.present? && sandbox.claude_login_user_id == user_id
+        login = SandboxOrchestrator.new.claude_login_status(sandbox)
+        return "sandbox_login" if login[:logged_in] && login[:auth_method] == "claude.ai"
+      end
+      "api_key" if sandbox.runtime_environment.present?
+    rescue LocalSandboxBackend::Error, SandboxOrchestrator::UnsupportedBackendError, SandboxOrchestrator::BackendError
+      "api_key" if sandbox.runtime_environment.present?
+    end
+
+    def sandbox_status(sandbox, user_id: nil)
+      mine = user_id.present? && sandbox.claude_login_user_id == user_id
+      login = if mine && sandbox.ready? && sandbox.active? && !backend_refusal(SandboxOrchestrator.new)
+        SandboxOrchestrator.new.claude_login_status(sandbox).slice(:logged_in, :auth_method)
+      else
+        { logged_in: false, auth_method: nil }
+      end
+      login = { logged_in: false, auth_method: nil } unless login[:logged_in] && login[:auth_method] == "claude.ai"
+      fallback = sandbox.runtime_environment.present? && !login_owner_refusal(sandbox, user_id: user_id) ? "api_key" : nil
+      login.merge(session_id: sandbox.session_id, owned_by_you: mine,
+        credential_mode: login[:logged_in] ? "sandbox_login" : fallback)
+    rescue StandardError
+      { session_id: sandbox.session_id, logged_in: false, auth_method: nil, owned_by_you: mine,
+        credential_mode: sandbox.runtime_environment.present? && !login_owner_refusal(sandbox, user_id: user_id) ? "api_key" : nil }
+    end
   end
 end

data/app/services/action_agent/codex_session_events.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  # Keep Codex's native JSONL transcript while adapting its terminal event
+  # to CodeSession's shared result contract. A process exit alone is never
+  # enough to mark a coding session successful.
+  class CodexSessionEvents
+    def consume(event)
+      return unless event.is_a?(Hash)
+
+      case event["type"]
+      when "thread.started"
+        @thread_id = event["thread_id"]
+      when "item.completed"
+        item = event["item"]
+        @answer = item["text"] if item.is_a?(Hash) && item["type"] == "agent_message"
+      when "turn.completed"
+        return result(false, @answer, event["usage"])
+      when "turn.failed", "error"
+        error = event["error"]
+        message = error.is_a?(Hash) ? error["message"] : event["message"]
+        return result(true, message.presence || "Codex reported a failed turn", {})
+      end
+      nil
+    end
+
+    private
+
+    def result(failed, answer, usage)
+      {
+        "type" => "result", "subtype" => failed ? "error_during_execution" : "success",
+        "is_error" => failed, "result" => answer, "session_id" => @thread_id,
+        "usage" => usage.is_a?(Hash) ? usage.slice("input_tokens", "output_tokens") : {}
+      }
+    end
+  end
+end