actionagent 1.8.1 → 1.9.1

data/app/controllers/action_agent/api/provider_keys_controller.rb

@@ -2,21 +2,50 @@
 
 module ActionAgent
   module Api
-    # Per-account LLM provider credentials (Settings -> Provider API Keys).
-    # API keys are write-only: responses carry a masked hint, never the key.
-    # Ollama's credential is a host URL and is echoed back in full; its
-    # optional API key (remote servers) is masked like the others. Claude
-    # Code's connection API key is stored here too, write-only like a key.
+    # LLM provider credentials (Settings -> Provider API Keys, and the
+    # Organization view's Provider keys). API keys are write-only: responses
+    # carry a masked hint, never the key. Ollama's credential is a host URL
+    # and is echoed back in full; its optional API key (remote servers) is
+    # masked like the others. Claude Code's connection API key is stored here
+    # too, write-only like a key.
+    #
+    # Every action takes a `scope` param:
+    #
+    #   organization  (default) the owner's shared keys. Writes and tests
+    #                 ask permission_checker for :manage_credentials.
+    #   personal      the signed-in user's own keys for the owner. Only
+    #                 that user's rows are read or changed, and every write
+    #                 and test is refused with 422 unless
+    #                 ProviderKey.personal_keys_enabled?. Saving a key needs
+    #                 no permission. Saving or testing a host (Ollama) asks
+    #                 for :manage_credentials, with the personal key as the
+    #                 subject, because the host decides where the server
+    #                 sends requests. Removing one's own key never asks.
     class ProviderKeysController < BaseController
-      before_action :require_owner!
+      SCOPES = %w[organization personal].freeze
 
-      # GET /api/provider_keys — one row per supported provider, configured or not.
+      before_action :require_owner!
+      before_action :require_known_scope!
+      before_action :require_personal_keys!, only: %i[create test destroy], if: :personal_scope?
+
+      # GET /api/provider_keys — one row per supported provider in the
+      # requested scope, configured or not.
+      #
+      # Beside the rows:
+      #   scope                         the scope listed
+      #   personal_keys_enabled         whether members may keep personal keys
+      #   can_manage_organization_keys  whether the caller may change the
+      #                                 organization's keys
       def index
-        configured = owned(ProviderKey).index_by(&:provider)
+        configured = scoped_keys.to_a.index_by(&:provider)
+        setters = setters_for(configured.values)
 
         render json: {
+          scope: requested_scope,
+          personal_keys_enabled: ProviderKey.personal_keys_enabled?,
+          can_manage_organization_keys: can_manage_organization_keys?,
           provider_keys: ProviderKey::PROVIDERS.map do |provider|
-            serialize(provider, configured[provider])
+            serialize(provider, configured[provider], setters)
           end
         }
       end
@@ -26,46 +55,160 @@ module ActionAgent
       # keeps the stored one, sending an empty string clears it.
       def create
         provider = params.require(:provider)
-        credential = params.require(:credential)
-
-        record = owned(ProviderKey).find_or_initialize_by(provider: provider)
-        attributes = { credential: credential }
-        attributes[:api_key] = params[:api_key].presence if params.key?(:api_key) && record.host_based?
-        record.update!(**attributes)
+        attempts = 0
+        begin
+          record = scoped_keys.find_or_initialize_by(provider: provider)
+          return unless authorize_write!(record)
+
+          attributes = { credential: params.require(:credential), set_by_id: signed_in_user&.id }
+          attributes[:api_key] = params[:api_key].presence if params.key?(:api_key) && record.host_based?
+          record.update!(**attributes)
+        rescue ActiveRecord::RecordNotUnique
+          # Another request saved this scope's key for the provider between
+          # the lookup and the insert. Looking again finds that row, and this
+          # request's credential replaces it, as a later save would.
+          retry if (attempts += 1) == 1
+          raise
+        end
 
-        render json: { provider_key: serialize(provider, record) }, status: :created
+        render json: { provider_key: serialize(provider, record, setters_for([ record ])) }, status: :created
       end
 
       # POST /api/provider_keys/test — checks that a host-based provider is
       # reachable and lists the models it serves. Tests the submitted host
       # (and api_key) when given, so a URL can be checked before saving;
-      # otherwise the stored credential, else the host app's default. Never
-      # persists anything.
+      # otherwise the scope's stored host, else the host app's default.
+      # Never persists anything.
+      #
+      # The stored api_key is sent only to the stored host: a submitted host
+      # that normalizes to anything else is probed with the submitted
+      # api_key, or with none.
       def test
         provider = params.require(:provider)
         unless ProviderKey::HOST_PROVIDERS.include?(provider)
           return render json: { error: "#{provider} is not a host-based provider" }, status: :unprocessable_entity
         end
 
-        stored = owned(ProviderKey).find_by(provider: provider)
-        host = params[:credential].presence || stored&.credential || platform_host(provider)
-        api_key = params.key?(:api_key) ? params[:api_key].presence : stored&.api_key
+        stored = scoped_keys.find_by(provider: provider)
+        return unless authorize_write!(stored || scoped_keys.new(provider: provider))
 
+        host = params[:credential].presence || stored&.credential || platform_host(provider)
         if host.blank?
           return render json: { ok: false, host: nil, models: [], latency_ms: nil, error: "No host configured" }
         end
 
-        render json: OllamaHostProbe.call(host: host, api_key: api_key).to_h
+        render json: OllamaHostProbe.call(host: host, api_key: probe_api_key(stored, host)).to_h
       end
 
       # DELETE /api/provider_keys/:provider
       def destroy
-        owned(ProviderKey).find_by!(provider: params[:provider]).destroy!
+        record = scoped_keys.find_by!(provider: params[:provider])
+        return unless personal_scope? || authorize_write!(record)
+
+        record.destroy!
         head :no_content
       end
 
       private
 
+      def requested_scope
+        @requested_scope ||= params[:scope].presence || "organization"
+      end
+
+      def personal_scope?
+        requested_scope == "personal"
+      end
+
+      def require_known_scope!
+        return if SCOPES.include?(requested_scope)
+
+        render json: { error: "scope must be one of #{SCOPES.join(', ')}" }, status: :unprocessable_entity
+      end
+
+      def require_personal_keys!
+        return if personal_keys_writable?
+
+        render json: {
+          error: "Personal provider keys are not enabled on this dashboard",
+          code: "personal_keys_disabled"
+        }, status: :unprocessable_entity
+      end
+
+      # Whether the signed-in user can hold personal keys here. The owner has
+      # to resolve to an account, or a personal write would have no account
+      # to belong to.
+      def personal_keys_writable?
+        ProviderKey.personal_keys_enabled? && signed_in_user.present? && ProviderKey.resolve_owner(current_owner).present?
+      end
+
+      # The keys of the requested scope: the organization's, or the signed-in
+      # user's own.
+      def scoped_keys
+        personal_scope? ? ProviderKey.personal_for(current_owner, signed_in_user) : owned(ProviderKey)
+      end
+
+      # The signed-in user, when it is an instance of the configured user
+      # class: the only caller that can hold personal keys or be recorded as
+      # a key's setter.
+      def signed_in_user
+        user_class = ProviderKey.owner_class_for(:user)
+        current_user if user_class && current_user.is_a?(user_class)
+      end
+
+      def authorize_write!(record)
+        return true unless needs_permission?(record)
+
+        authorize_action!(:manage_credentials, record)
+      end
+
+      # Whether saving or testing +record+ asks for :manage_credentials.
+      def needs_permission?(record)
+        !personal_scope? || record.host_based?
+      end
+
+      # Whether the caller may save and test +provider+'s credential in the
+      # requested scope.
+      def editable?(provider, record)
+        return can_manage_organization_keys? unless personal_scope?
+        return false if !personal_keys_writable? || ProviderKey::CONNECTION_PROVIDERS.include?(provider)
+
+        record ||= scoped_keys.new(provider: provider)
+        !needs_permission?(record) || ActionAgent.permitted?(current_user, :manage_credentials, record)
+      end
+
+      def can_manage_organization_keys?
+        return @can_manage_organization_keys if defined?(@can_manage_organization_keys)
+
+        @can_manage_organization_keys = ActionAgent.permitted?(current_user, :manage_credentials, owned(ProviderKey).new)
+      end
+
+      def probe_api_key(stored, host)
+        return params[:api_key].presence if params.key?(:api_key)
+        return nil if stored.nil?
+
+        stored.api_key if ProviderKey.normalize_host(host) == ProviderKey.normalize_host(stored.credential)
+      end
+
+      # The users who last saved +records+, by id, read in one query.
+      def setters_for(records)
+        ids = records.filter_map(&:set_by_id).uniq
+        user_class = ProviderKey.owner_class_for(:user)
+        return {} if ids.empty? || user_class.nil?
+
+        user_class.where(id: ids).index_by(&:id)
+      end
+
+      # The source the caller's own runs use for +provider+, or nil for a
+      # connection credential, which no run generates on, and when the
+      # caller's credentials cannot be resolved.
+      def effective_source(provider)
+        return nil if ProviderKey::CONNECTION_PROVIDERS.include?(provider)
+
+        ProviderCredentials.resolve(owner: current_owner, actor: current_user, provider: provider).source
+      rescue ProviderCredentials::Unresolved
+        nil
+      end
+
       # The host app's default (config/active_agent.yml, e.g. OLLAMA_HOST)
       # that applies when the owner has not configured their own.
       def platform_host(provider)
@@ -77,11 +220,13 @@ module ActionAgent
         nil
       end
 
-      def serialize(provider, record)
+      def serialize(provider, record, setters)
         host_based = ProviderKey::HOST_PROVIDERS.include?(provider)
+        setter = record&.set_by_id && setters[record.set_by_id]
 
         {
           provider: provider,
+          scope: requested_scope,
           host_based: host_based,
           # "key", "host", or "connection" (Settings -> Integrations rather
           # than Provider API Keys).
@@ -95,9 +240,16 @@ module ActionAgent
           # from an earlier version: never used, and the UI asks for an API
           # key in its place.
           needs_replacing: record.present? && record.needs_replacing?,
+          editable: editable?(provider, record),
+          effective_source: effective_source(provider),
+          set_by: setter && { id: setter.id, name: display_name(setter) },
           updated_at: record&.updated_at&.iso8601
         }
       end
+
+      def display_name(user)
+        user.try(:display_name) || user.try(:name) || user.try(:email_address) || user.try(:email)
+      end
     end
   end
 end

data/app/controllers/action_agent/api/provider_models_controller.rb

@@ -7,11 +7,12 @@ module ActionAgent
     #
     # Hosted providers get a curated list of current models (kept here, server
     # side, so the UI can't drift stale). Ollama is queried live from the
-    # account's configured host (Settings -> Provider API Keys, falling back to
-    # the platform config) so locally pulled models appear; OpenRouter is
-    # queried from its public catalog, and Anthropic from its Models API with
-    # the account's key. Live lookups fall back to the curated list on any
-    # failure.
+    # caller's effective host (see ProviderCredentials: their personal key,
+    # the host resolver's, the account's, falling back to the platform
+    # config) so locally pulled models appear; OpenRouter is queried from its
+    # public catalog, and Anthropic from its Models API with the caller's
+    # effective key. Live lookups fall back to the curated list on any
+    # failure, and when the caller's credentials cannot be resolved.
     #
     # When the host app loads RubyLLM, the chat models its registry lists for
     # the provider that take and return text follow: RubyLLM's bundled
@@ -55,16 +56,36 @@ module ActionAgent
 
       private
 
-      # The owner's configured Ollama endpoint, else the host app's default
+      # The caller's effective Ollama endpoint, else the host app's default
       # from config/active_agent.yml.
       def ollama_host
-        key = owner_provider_key("ollama")
-        host = key&.credential.presence || ActiveAgent.configuration[:ollama]&.dig(:host)
-        host.presence
+        resolution = credentials("ollama")
+        return nil if resolution.nil?
+
+        options = resolution.options
+        host = options[:host].presence || options[:base_url].presence || options[:uri_base].presence
+        (host || ActiveAgent.configuration[:ollama]&.dig(:host)).presence
+      end
+
+      # The caller's effective credentials for +provider+, or nil when they
+      # cannot be resolved.
+      def credentials(provider)
+        @credentials ||= {}
+        return @credentials[provider] if @credentials.key?(provider)
+
+        @credentials[provider] = begin
+          resolution = ProviderCredentials.resolve(owner: current_owner, actor: current_user, provider: provider)
+          resolution.options = resolution.options.symbolize_keys
+          resolution
+        rescue ProviderCredentials::Unresolved => e
+          Rails.logger.warn("[ProviderModels] #{e.message}")
+          nil
+        end
       end
 
-      def owner_provider_key(provider)
-        owned(ProviderKey).find_by(provider: provider)
+      def credential_key(provider)
+        options = credentials(provider)&.options || {}
+        options[:access_token].presence || options[:api_key].presence
       end
 
       # Same probe as Settings -> "Test connection", so the builder's dropdown
@@ -74,7 +95,7 @@ module ActionAgent
         host = ollama_host
         return nil unless host
 
-        result = OllamaHostProbe.call(host: host, api_key: owner_provider_key("ollama")&.api_key)
+        result = OllamaHostProbe.call(host: host, api_key: credential_key("ollama"))
         unless result.ok
           Rails.logger.warn("[ProviderModels] ollama lookup failed: #{result.error}")
           return nil
@@ -83,10 +104,11 @@ module ActionAgent
         [ result.models, "live" ] if result.models.any?
       end
 
-      # Queries the Anthropic Models API with the account's key (newest first,
-      # as returned by the API) so new model releases appear without a deploy.
+      # Queries the Anthropic Models API with the caller's effective key
+      # (newest first, as returned by the API) so new model releases appear
+      # without a deploy. The platform's own key is never used here.
       def live_anthropic_models
-        key = owner_provider_key("anthropic")&.credential
+        key = credential_key("anthropic")
         return nil if key.blank?
 
         data = Rails.cache.fetch("provider_models:anthropic:#{Digest::SHA256.hexdigest(key)}", expires_in: 1.hour) do

data/app/controllers/action_agent/api/recording_event_ingest_controller.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require "stringio"
+require "zlib"
+
+module ActionAgent
+  module Api
+    # POST <mount>/api/session_recordings/:id/events with a recording's
+    # ingest token as the bearer token: a recorder outside the dashboard,
+    # such as a sandbox's browser, posting a batch of events
+    # (RecordingEventIngest).
+    #
+    # The token authenticates on its own, so this is not a dashboard
+    # controller and sees no session, no forgery protection and none of the
+    # host's controller concerns. It is accepted only for the recording it
+    # was issued for, while SessionRecording#ingest_token_valid? holds, and
+    # only for RecordingEvent::CLIENT_KINDS. It reads nothing back. A request
+    # without a bearer token is routed to SessionRecordingsController#create_events.
+    #
+    # A batch may be sent gzipped, with Content-Encoding: gzip, as a sandbox's
+    # browser sends it. It is inflated no further than the batch size limit.
+    class RecordingEventIngestController < ActionController::API
+      wrap_parameters false
+
+      def create
+        recording = SessionRecording.find_by(id: request.path_parameters[:id])
+        unless recording&.ingest_token_valid?(bearer_token)
+          return render(json: { error: "Invalid or expired recording token" }, status: :unauthorized)
+        end
+
+        body = batch_body
+        return if performed?
+
+        result = RecordingEventIngest.call(recording, body)
+        render json: result.body, status: result.status
+      end
+
+      private
+
+      # The request body, inflated when it was gzipped. Renders the refusal
+      # instead when the encoding is unsupported, the gzip is damaged, or it
+      # inflates past the batch size limit.
+      def batch_body
+        encoding = request.headers["Content-Encoding"].to_s.strip.downcase
+        return request.raw_post if encoding.empty? || encoding == "identity"
+        unless encoding == "gzip"
+          return render(json: { error: "Content-Encoding must be gzip or identity" }, status: :unsupported_media_type)
+        end
+
+        limit = RecordingEvent.limits[:batch_bytes]
+        inflated = Zlib::GzipReader.new(StringIO.new(request.raw_post)).read(limit + 1).to_s
+        if inflated.bytesize > limit
+          return render(json: { error: "The batch is over the limit of #{limit} bytes", code: "recording_limit" },
+            status: RecordingEventIngest::PAYLOAD_TOO_LARGE)
+        end
+
+        inflated.force_encoding(Encoding::UTF_8)
+      rescue Zlib::Error
+        render json: { error: "The body is not valid gzip" }, status: :bad_request
+      end
+
+      def bearer_token
+        request.authorization.to_s[/\ABearer\s+(.+)\z/i, 1]
+      end
+    end
+  end
+end

data/app/controllers/action_agent/api/sandbox_browser_tickets_controller.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  module Api
+    # Tickets into a checkout sandbox browser's live view (BrowserLiveTicket):
+    #
+    #   POST /api/sandboxes/:sandbox_id/browser/tickets
+    #        mode: "view" (the default) to watch, or "control" to also take over
+    #
+    # Answers 201 with { ticket:, mode:, expires_at:, url: }, where url is
+    # the live view's WebSocket and the ticket is its first message.
+    #
+    # A view ticket needs only access to the sandbox, found the way
+    # SandboxBrowsersController finds it. A control ticket also needs
+    # ActionAgent.permitted?(user, :take_over_browser, sandbox), and execution
+    # to be enabled. A browser that is not running, or that has no live view,
+    # answers 409.
+    class SandboxBrowserTicketsController < BaseController
+      before_action :set_sandbox
+
+      def create
+        mode = params[:mode].presence || "view"
+        unless BrowserLiveTicket::MODES.include?(mode)
+          return render json: { error: "mode must be one of #{BrowserLiveTicket::MODES.join(', ')}" }, status: :unprocessable_entity
+        end
+        if mode == "control"
+          require_execution_enabled!
+          return if performed?
+          return unless authorize_action!(:take_over_browser, @sandbox)
+        end
+        unless @sandbox.browser_running? && @sandbox.browser_live_url.present?
+          return render json: { error: "The sandbox's browser has no live view to open", browser: @sandbox.browser_summary },
+            status: :conflict
+        end
+
+        issued = BrowserLiveTicket.issue(@sandbox, user: current_user, mode: mode)
+        response.headers["Cache-Control"] = "no-store"
+        render json: issued.merge(expires_at: issued[:expires_at].iso8601, url: @sandbox.browser_live_url), status: :created
+      end
+
+      private
+
+      def set_sandbox
+        scope = owned(SandboxSession)
+        scope = scope.where.not(sandbox_type: "app_runtime").or(scope.where(account_id: current_account.id)) if current_account
+        @sandbox = scope.find_by!(session_id: params[:sandbox_id])
+      end
+    end
+  end
+end

data/app/controllers/action_agent/api/sandbox_browsers_controller.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  module Api
+    # A checkout sandbox's browser (SandboxBrowser):
+    #
+    #   GET    /api/sandboxes/:sandbox_id/browser  { browser: }
+    #   POST   /api/sandboxes/:sandbox_id/browser  starts it; mode ("headless",
+    #          the default, or "headed") and capabilities (optional tool groups)
+    #   DELETE /api/sandboxes/:sandbox_id/browser  stops it
+    #
+    # Found the way SandboxesController finds a checkout: among the caller's
+    # sandboxes, within their current account. A response carries the
+    # browser's mode, status, server key and live view URL, never its MCP
+    # endpoint or token. The live view may be opened from the dashboard
+    # origin the browser was started from, and from
+    # ActionAgent.browser_live_origins.
+    class SandboxBrowsersController < BaseController
+      # A browser runs the sandbox app's pages: the same gate as running an
+      # agent, and its own plan limit.
+      before_action :require_execution_enabled!, only: [ :create ]
+      before_action :set_sandbox
+      before_action -> { enforce_quota!(:browser_minutes) }, only: [ :create ]
+
+      def show
+        render json: { browser: @sandbox.browser_summary }
+      end
+
+      def create
+        SandboxBrowser.start(
+          @sandbox,
+          mode: params[:mode].presence || "headless",
+          capabilities: capability_params,
+          recording_url: ->(recording) { events_api_session_recording_url(recording) },
+          live_origins: [ request.base_url, *ActionAgent.browser_live_origins ]
+        )
+        render json: { browser: @sandbox.browser_summary }, status: :created
+      rescue SandboxBrowser::Error => e
+        render json: { error: e.message, browser: @sandbox.reload.browser_summary }, status: :unprocessable_entity
+      end
+
+      def destroy
+        SandboxBrowser.stop(@sandbox)
+        render json: { browser: @sandbox.browser_summary }
+      rescue SandboxBrowser::Error => e
+        render json: { error: e.message, browser: @sandbox.browser_summary }, status: :unprocessable_entity
+      end
+
+      private
+
+      def set_sandbox
+        scope = owned(SandboxSession)
+        scope = scope.where.not(sandbox_type: "app_runtime").or(scope.where(account_id: current_account.id)) if current_account
+        @sandbox = scope.find_by!(session_id: params[:sandbox_id])
+      end
+
+      def capability_params
+        value = params[:capabilities]
+        return [] if value.blank?
+
+        value.is_a?(Array) ? value.map(&:to_s) : [ value.to_s ]
+      end
+    end
+  end
+end