actionagent 1.8.1 → 1.9.0

data/app/services/action_agent/browser_sign_in.rb

@@ -0,0 +1,163 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  # Used to sign a project's sandbox browser in to the app with a sign_in
+  # ProjectSecret, from the Rails process, so the credentials never reach a
+  # model: they are typed into the form by SandboxBrowserDriver and appear in
+  # no tool argument, tool result, log line, span or recorded action. The
+  # browser's own recording masks what is typed.
+  #
+  # The form is found on the secret's login_url: the password field, then the
+  # login field and the submit button near it, unless the secret names them
+  # with CSS selectors. The browser is signed in once the page it shows has
+  # no password field. Otherwise the password field is emptied, so a later
+  # page snapshot cannot show it.
+  class BrowserSignIn
+    # The outcome, as the explorer's sign_in tool and the test account step
+    # report it:
+    #
+    #   signed_in    the browser left the login form
+    #   failed       it still shows a password field, as after a wrong
+    #                password
+    #   unsupported  the login page has no password field, as with sign-in
+    #                through another site (OAuth or SSO)
+    #   error        the browser could not be driven
+    Result = Struct.new(:status, :message, keyword_init: true) do
+      def signed_in?
+        status == "signed_in"
+      end
+
+      def to_h
+        { status: status, signed_in: signed_in?, message: message }
+      end
+    end
+
+    MESSAGES = {
+      "signed_in" => "Signed in: the browser left the login form.",
+      "failed" => "The browser still shows the login form after submitting it. Check the login and password.",
+      "unsupported" => "The login page has no password field, so the app's sign-in (OAuth or SSO only) is not " \
+                       "supported in the sandbox.",
+      "error" => "The sandbox's browser could not be driven to sign in."
+    }.freeze
+
+    PASSWORD_TARGET = '[data-aa-sign-in="password"]'
+    LOGIN_TARGET = '[data-aa-sign-in="login"]'
+    SUBMIT_TARGET = '[data-aa-sign-in="submit"]'
+    LOGIN_CANDIDATES = 'input[type="email"], input[autocomplete="username"], input[autocomplete="email"], ' \
+                       'input[name*="email" i], input[name*="login" i], input[name*="user" i], input[type="text"]'
+    # How long a sign-in that has not left the login form yet is given before
+    # it counts as failed.
+    SETTLE_SECONDS = 2
+    VISIBLE = "(el) => !!(el && (el.offsetWidth || el.offsetHeight || el.getClientRects().length))"
+    CLEAR_PASSWORDS = "() => { document.querySelectorAll('input[type=\"password\"]').forEach((el) => { el.value = ''; }); return true; }"
+
+    # @param sandbox [SandboxSession] with its browser running
+    # @param secret [ProjectSecret] a sign_in secret
+    # @return [Result]
+    def self.call(sandbox, secret, driver: nil)
+      new(sandbox, secret, driver).call
+    end
+
+    def initialize(sandbox, secret, driver)
+      @sandbox = sandbox
+      @secret = secret
+      @driver = driver
+    end
+
+    def call
+      credentials = @secret.sign_in_credentials
+      return result("failed") if credentials["password"].blank?
+
+      driver.open(credentials["login_url"])
+      marks = driver.evaluate(mark_fields(credentials))
+      return result("unsupported") unless marks.is_a?(Hash) && marks["password"] == true
+
+      login_path = marks["path"]
+      driver.type(LOGIN_TARGET, credentials["login"]) if marks["login"] == true && credentials["login"].present?
+      if marks["submit"] == true
+        driver.type(PASSWORD_TARGET, credentials["password"])
+        driver.click(SUBMIT_TARGET)
+      else
+        driver.type(PASSWORD_TARGET, credentials["password"], submit: true)
+      end
+
+      return result("signed_in") if left_form?(credentials, login_path)
+
+      driver.evaluate(CLEAR_PASSWORDS)
+      result("failed")
+    rescue SandboxBrowserDriver::Error => e
+      Rails.logger.warn("[ActionAgent] sign-in in sandbox #{@sandbox.session_id} failed: #{e.message}")
+      clear_quietly
+      result("error")
+    end
+
+    private
+
+    def driver
+      @driver ||= SandboxBrowserDriver.new(@sandbox)
+    end
+
+    def result(status)
+      Result.new(status: status, message: MESSAGES.fetch(status))
+    end
+
+    # Whether the browser shows a page without a password field: at once on
+    # a page other than +login_path+, or on any page after SETTLE_SECONDS,
+    # for an app that redirects late or whose signed-in page shares the
+    # login page's path. A failure the app renders on another path, such as
+    # the form's POST path, still shows the field.
+    def left_form?(credentials, login_path)
+      state = page_state(credentials)
+      return true if state && state["path"] != login_path && !state["passwordField"]
+
+      driver.wait(SETTLE_SECONDS)
+      state = page_state(credentials)
+      state.present? && !state["passwordField"]
+    end
+
+    # { "path", "passwordField" }: the page's path, and whether it shows the
+    # secret's password field or any visible one. Nil when the page does not
+    # answer.
+    def page_state(credentials)
+      state = driver.evaluate(<<~JS.squish)
+        () => {
+          const visible = #{VISIBLE};
+          let named = null;
+          try { named = #{credentials['password_field'].to_json} ? document.querySelector(#{credentials['password_field'].to_json}) : null; } catch (e) {}
+          const field = named || [...document.querySelectorAll('input[type="password"]')].find(visible);
+          return { path: location.pathname, passwordField: visible(field) };
+        }
+      JS
+      state.is_a?(Hash) ? state : nil
+    end
+
+    def clear_quietly
+      @driver&.evaluate(CLEAR_PASSWORDS)
+    rescue SandboxBrowserDriver::Error
+      nil
+    end
+
+    # The page function that finds the sign-in form and marks its fields
+    # with data-aa-sign-in, answering which it found. Selectors from the
+    # secret are passed as JSON string literals.
+    def mark_fields(credentials)
+      password, login, submit = credentials.values_at("password_field", "login_field", "submit_field").map(&:to_json)
+      <<~JS.squish
+        () => {
+          const visible = #{VISIBLE};
+          const pick = (selector) => { try { return selector ? document.querySelector(selector) : null; } catch (e) { return null; } };
+          document.querySelectorAll('[data-aa-sign-in]').forEach((el) => el.removeAttribute('data-aa-sign-in'));
+          const password = pick(#{password}) || [...document.querySelectorAll('input[type="password"]')].find(visible);
+          if (!password) return { password: false, path: location.pathname };
+          const scope = password.form || document;
+          const login = pick(#{login}) || [...scope.querySelectorAll(#{LOGIN_CANDIDATES.to_json})].find((el) => el !== password && visible(el));
+          const submit = pick(#{submit}) || scope.querySelector('button[type="submit"], input[type="submit"]') || scope.querySelector('button:not([type])');
+          password.setAttribute('data-aa-sign-in', 'password');
+          if (login) login.setAttribute('data-aa-sign-in', 'login');
+          if (submit) submit.setAttribute('data-aa-sign-in', 'submit');
+          return { password: true, login: !!login, submit: !!submit, path: location.pathname };
+        }
+      JS
+    end
+  end
+end

data/app/services/action_agent/browser_tool_redaction.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  # Masks what a browser tool call typed: the `text` of `browser_type` and
+  # `browser_press_sequentially`, the `promptText` of `browser_handle_dialog`
+  # and each field `value` of `browser_fill_form`. MCPRecordingMiddleware applies it before an agent's
+  # browser action is stored, and SessionTimeline before a tool call is
+  # shown.
+  #
+  # Masking is per call. A value one call typed is masked in that call's
+  # arguments and result, but not in another call's result that shows it,
+  # such as a later snapshot of the filled field.
+  module BrowserToolRedaction
+    MASK = "[REDACTED]"
+    # The argument that holds what each single-value typing tool typed.
+    TYPED_ARGUMENTS = {
+      "browser_type" => "text", "browser_press_sequentially" => "text", "browser_handle_dialog" => "promptText"
+    }.freeze
+    TYPING_TOOLS = [ *TYPED_ARGUMENTS.keys, "browser_fill_form" ].freeze
+    # Shorter typed values are masked in the arguments but not searched for
+    # in other text, where they would mask unrelated characters.
+    MIN_SEARCHED_LENGTH = 3
+
+    module_function
+
+    def typing_tool?(tool_name)
+      TYPING_TOOLS.include?(tool_name.to_s)
+    end
+
+    # Returns +arguments+ with the typed values masked, in the form given: a
+    # Hash, or JSON text. Arguments of a typing tool that cannot be read as a
+    # Hash, such as JSON cut off mid-string, are masked whole. Other tools'
+    # arguments are returned unchanged.
+    def redact_arguments(tool_name, arguments)
+      return arguments unless typing_tool?(tool_name)
+
+      parsed = parse(arguments)
+      return MASK unless parsed.is_a?(Hash)
+
+      typed = TYPED_ARGUMENTS[tool_name.to_s]
+      masked =
+        if typed
+          parsed.key?(typed) ? parsed.merge(typed => MASK) : parsed
+        else
+          parsed.merge("fields" => Array(parsed["fields"]).map { |field| mask_field(field) })
+        end
+      arguments.is_a?(String) ? masked.to_json : masked
+    end
+
+    # Returns +text+, such as a tool result, with the values the call typed
+    # masked. A typing tool's text is masked whole when its +arguments+
+    # cannot be read. Other tools' text is returned unchanged.
+    def redact_text(tool_name, text, arguments)
+      return text unless typing_tool?(tool_name) && text.is_a?(String)
+
+      parsed = parse(arguments)
+      return MASK unless parsed.is_a?(Hash)
+
+      typed_values(tool_name, parsed)
+        .select { |value| value.length >= MIN_SEARCHED_LENGTH }
+        .sort_by { |value| -value.length }
+        .reduce(text) { |masked, value| masked.gsub(value, MASK) }
+    end
+
+    # The values a typing tool call typed, from its parsed arguments.
+    def typed_values(tool_name, parsed)
+      typed = TYPED_ARGUMENTS[tool_name.to_s]
+      values = typed ? [ parsed[typed] ] : Array(parsed["fields"]).map { |field| field["value"] if field.is_a?(Hash) }
+      values.compact.map(&:to_s).reject(&:empty?)
+    end
+
+    def mask_field(field)
+      return field unless field.is_a?(Hash)
+
+      field = field.deep_stringify_keys
+      field.key?("value") ? field.merge("value" => MASK) : field
+    end
+
+    # +arguments+ as a string-keyed Hash: a Hash as given, JSON text parsed.
+    # Anything else, or JSON that does not parse, is returned as nil.
+    def parse(arguments)
+      case arguments
+      when Hash then arguments.deep_stringify_keys
+      when String
+        parsed = JSON.parse(arguments)
+        parsed.is_a?(Hash) ? parsed : nil
+      end
+    rescue JSON::ParserError
+      nil
+    end
+  end
+end

data/app/services/action_agent/claude_code_auth.rb

@@ -14,8 +14,8 @@ module ActionAgent
   #              LocalSandboxBackend.claude_login_status). The dashboard never
   #              sees that credential.
   #
-  # Anthropic does not let third-party products store or route requests
-  # through Claude.ai subscription credentials, so there is no third mode:
+  # :sandbox_login is the user's login inside the unmodified CLI. Only the
+  # CLI holds its credential; the dashboard relays a one-use login code.
   # https://code.claude.com/docs/en/legal-and-compliance.md
   module ClaudeCodeAuth
     module_function
@@ -29,6 +29,12 @@ module ActionAgent
       mode == "local_login"
     end
 
+    def sandbox_login?
+      mode == "sandbox_login"
+    end
+
+    LOGIN_VERBS = %i[start_claude_login submit_claude_login_code claude_login_status claude_logout].freeze
+
     # Why +orchestrator+'s backend cannot run Claude Code sessions with the
     # configured authentication, or nil. A machine's own login is the
     # dashboard user's, so only a backend running sessions as that user, on
@@ -36,6 +42,15 @@ module ActionAgent
     # find no login or need it copied there, which is what this mode exists
     # to never do.
     def backend_refusal(orchestrator)
+      if sandbox_login?
+        unless LOGIN_VERBS.all? { |verb| orchestrator.supports?(verb) }
+          return "The #{orchestrator.backend_name} backend does not implement sandbox Claude login (#{LOGIN_VERBS.join(', ')})"
+        end
+        unless orchestrator.local? || ActionAgent.claude_code_hosted_login_enabled
+          return "Hosted Claude subscription login is disabled; the operator must review the hosting requirements and enable it explicitly"
+        end
+        return
+      end
       return unless local_login?
       return if orchestrator.local?
 
@@ -53,12 +68,15 @@ module ActionAgent
     # +provider_keys+: booleans and the login's method, never a credential.
     #
     # @return [Hash] { mode:, connected:, login: } (login for :local_login only)
-    def status(provider_keys)
+    def status(provider_keys, sandboxes: [], user_id: nil)
       if local_login?
         # Only the :local backend uses the login, and no other one needs
         # this machine's CLI asked about it.
         login = local_backend? ? LocalSandboxBackend.claude_login_status : LocalSandboxBackend::LOGGED_OUT
         { mode: mode, connected: login[:logged_in], login: login.slice(:logged_in, :auth_method) }
+      elsif sandbox_login?
+        sessions = Array(sandboxes).map { |sandbox| sandbox_status(sandbox, user_id: user_id) }
+        { mode: mode, connected: api_key_connected?(provider_keys) || sessions.any? { |row| row[:logged_in] }, sandboxes: sessions }
       else
         { mode: mode, connected: api_key_connected?(provider_keys) }
       end
@@ -73,7 +91,15 @@ module ActionAgent
 
     # Why a Claude Code session cannot start in +sandbox+ for want of
     # credentials, or nil.
-    def credential_refusal(sandbox)
+    def credential_refusal(sandbox, user_id: nil)
+      if sandbox_login?
+        if (refusal = login_owner_refusal(sandbox, user_id: user_id))
+          return refusal
+        end
+        return if credential_mode(sandbox, user_id: user_id)
+
+        return "Sign in with your own Claude subscription in this sandbox, or connect an Anthropic API key"
+      end
       if local_login?
         return if LocalSandboxBackend.claude_login_status[:logged_in]
 
@@ -82,5 +108,45 @@ module ActionAgent
         "Claude Code is not connected: connect an Anthropic API key in Settings -> Integrations first"
       end
     end
+
+    # Why +user_id+ may run nothing in +sandbox+ under :sandbox_login, or nil.
+    # Every session runs as the same OS user beside the signed-in member's
+    # CLAUDE_CONFIG_DIR, so while one member's login is there no one else's
+    # session, on any runner or credential, may run in that checkout.
+    def login_owner_refusal(sandbox, user_id: nil)
+      return unless sandbox_login?
+      owner = sandbox.try(:claude_login_user_id)
+      return if owner.nil? || (user_id.present? && owner == user_id)
+
+      "Another member is signed in to Claude Code in this sandbox; start your own sandbox"
+    end
+
+    def credential_mode(sandbox, user_id: nil)
+      return mode unless sandbox_login?
+      return if login_owner_refusal(sandbox, user_id: user_id)
+      if user_id.present? && sandbox.claude_login_user_id == user_id
+        login = SandboxOrchestrator.new.claude_login_status(sandbox)
+        return "sandbox_login" if login[:logged_in] && login[:auth_method] == "claude.ai"
+      end
+      "api_key" if sandbox.runtime_environment.present?
+    rescue LocalSandboxBackend::Error, SandboxOrchestrator::UnsupportedBackendError, SandboxOrchestrator::BackendError
+      "api_key" if sandbox.runtime_environment.present?
+    end
+
+    def sandbox_status(sandbox, user_id: nil)
+      mine = user_id.present? && sandbox.claude_login_user_id == user_id
+      login = if mine && sandbox.ready? && sandbox.active? && !backend_refusal(SandboxOrchestrator.new)
+        SandboxOrchestrator.new.claude_login_status(sandbox).slice(:logged_in, :auth_method)
+      else
+        { logged_in: false, auth_method: nil }
+      end
+      login = { logged_in: false, auth_method: nil } unless login[:logged_in] && login[:auth_method] == "claude.ai"
+      fallback = sandbox.runtime_environment.present? && !login_owner_refusal(sandbox, user_id: user_id) ? "api_key" : nil
+      login.merge(session_id: sandbox.session_id, owned_by_you: mine,
+        credential_mode: login[:logged_in] ? "sandbox_login" : fallback)
+    rescue StandardError
+      { session_id: sandbox.session_id, logged_in: false, auth_method: nil, owned_by_you: mine,
+        credential_mode: sandbox.runtime_environment.present? && !login_owner_refusal(sandbox, user_id: user_id) ? "api_key" : nil }
+    end
   end
 end

data/app/services/action_agent/dashboard_assistant_service.rb

@@ -90,8 +90,11 @@ module ActionAgent
       }
     ].freeze
 
-    def initialize(owner:, message: nil, history: [], provider: nil, model: nil, allow_provider_processing: false)
+    # +actor+ is the signed-in user, whose effective provider key the
+    # assistant generates with (see ProviderCredentials).
+    def initialize(owner:, actor: nil, message: nil, history: [], provider: nil, model: nil, allow_provider_processing: false)
       @owner = owner
+      @actor = actor
       @message = message
       @history = history
       @provider = provider
@@ -107,7 +110,7 @@ module ActionAgent
 
     def configuration
       {
-        providers: DEFAULT_MODELS.map { |id, model| { id: id, configured: provider_configured?(id), default_model: model } },
+        providers: DEFAULT_MODELS.map { |id, model| { id: id, configured: configuration_provider_configured?(id), default_model: model } },
         defaults: { provider: nil, model: nil },
         processing: { consent_required: true, disclosure: PROCESSING_DISCLOSURE },
         connections: connections,
@@ -200,17 +203,22 @@ module ActionAgent
     # sessions are started from that view (see LIMITATIONS).
     #
     # Claude Code is connected by ClaudeCodeAuth's rule, as the sandbox
-    # listing reports it: an API key the owner connected (auth "api_key"), or
-    # this machine's own login (auth "local_login", with its status).
+    # listing reports it: an API key the owner connected (auth "api_key"),
+    # this machine's own login (auth "local_login", with its status), or a
+    # login inside each checkout sandbox (auth "sandbox_login", with the
+    # actor's per-sandbox state under sandboxes).
     def connections
-      claude_code = ClaudeCodeAuth.status(ProviderKey.for_owner(@owner))
+      claude_code = ClaudeCodeAuth.status(ProviderKey.for_owner(@owner),
+        sandboxes: SandboxSession.for_owner(@owner).where(sandbox_type: "app_runtime").recent.limit(20),
+        user_id: @actor.respond_to?(:id) ? @actor.id : nil)
       {
         github: { supported: true, connected: GithubConnection.for_owner(@owner).exists? },
         claude_code: {
           supported: code_sessions_supported?,
           connected: claude_code[:connected],
           auth: claude_code[:mode],
-          login: claude_code[:login]
+          login: claude_code[:login],
+          sandboxes: claude_code[:sandboxes]
         }.compact,
         coi: { supported: false }
       }
@@ -278,10 +286,16 @@ module ActionAgent
 
     def provider_options(provider)
       @provider_options ||= {}
-      @provider_options[provider] ||= begin
-        host = ActionAgent.provider_credentials(@owner, provider)
-        (host.presence || ProviderKey.for_owner(@owner).find_by(provider: provider)&.generation_options || {}).symbolize_keys
-      end
+      @provider_options[provider] ||=
+        ProviderCredentials.resolve(owner: @owner, actor: @actor, provider: provider).options.symbolize_keys
+    end
+
+    # The configuration lists a provider whose credentials cannot be
+    # resolved as not configured; a request for it fails in #validate!.
+    def configuration_provider_configured?(provider)
+      provider_configured?(provider)
+    rescue ProviderCredentials::Unresolved
+      false
     end
 
     def provider_configured?(provider)