actionagent 1.8.1 → 1.9.1

data/app/models/concerns/action_agent/ownable.rb

@@ -14,8 +14,14 @@ module ActionAgent
   # So an app with users scopes agents per user, an app with only accounts
   # scopes them per account, and a single-user self-hosted install declares
   # neither association and owns everything implicitly. That ordering is
-  # per-model on purpose: an app can reasonably keep agents per user while
-  # keeping API keys per account, and the platform does exactly that.
+  # per-model on purpose: an app can keep agents per user while keeping API
+  # keys per account. A host that configures both classes and wants the
+  # account to own everything re-declares `owned_by :account, :user` on the
+  # user-first models from `to_prepare`, as the hosted platform does.
+  #
+  # An owner is matched by its class, never by its id alone (see .for_owner):
+  # the two owner tables share an id space, so `where(account_id: user.id)`
+  # reads whichever account happens to share that user's id.
   #
   # Both foreign keys exist in the engine's schema either way, so moving a
   # deployment between shapes is a configuration change, not a migration.
@@ -30,7 +36,7 @@ module ActionAgent
         @owner_candidates = candidates.map(&:to_sym)
 
         @owner_candidates.each do |candidate|
-          class_name = ActionAgent.public_send(CLASS_FOR.fetch(candidate))
+          class_name = owner_class_name(candidate)
           next if class_name.blank?
 
           belongs_to candidate, class_name: class_name, optional: true
@@ -44,7 +50,20 @@ module ActionAgent
       # The association this install owns the model through, or nil when the
       # host app configured no owner model at all.
       def owner_association
-        owner_candidates.find { |c| ActionAgent.public_send(CLASS_FOR.fetch(c)).present? }
+        owner_candidates.find { |candidate| owner_class_name(candidate).present? }
+      end
+
+      # The class the host configured for +association+, or nil when it is
+      # unset or names nothing loaded.
+      def owner_class_for(association = owner_association)
+        return nil if association.nil?
+
+        owner_class_name(association)&.safe_constantize
+      end
+
+      # The class name the host configured for +association+, or nil.
+      def owner_class_name(association)
+        ActionAgent.public_send(CLASS_FOR.fetch(association)).presence
       end
 
       # Scopes to records owned by +owner+.
@@ -58,15 +77,50 @@ module ActionAgent
       #     request, or a resolver that returned nil. Returning `all` here
       #     would hand one tenant every other tenant's records, so it
       #     returns nothing instead.
+      #
+      # An owner of another class than the configured one also scopes to
+      # nothing. A user handed to an account-owned model is first mapped to
+      # its tenant through `ActionAgent.tenant_for`, so a host that resolves
+      # tenants reads that tenant's rows; without a tenant resolver the user
+      # is nobody's account and reads nothing.
+      #
+      # Only the rows .owned_rows admits are returned.
       def for_owner(owner)
-        return all if owner_association.nil?
+        return owned_rows if owner_association.nil?
+
+        owner = resolve_owner(owner)
         return none if owner.nil?
 
-        case owner_association
-        when :account then where(account_id: owner.id)
-        when :user then where(user_id: owner.id)
-        else all
-        end
+        owned_rows.where("#{owner_association}_id": owner.id)
+      end
+
+      # The rows an owner's scope reads: every row, unless the model holds
+      # rows its owner does not share, which it leaves out here. .for_owner
+      # and the dashboard API's `owned` both apply it.
+      def owned_rows
+        all
+      end
+
+      # +owner+ as an instance of the configured owner class: itself when it
+      # is one, its tenant when it is a user and this model is owned by
+      # account, nil otherwise.
+      def resolve_owner(owner)
+        return nil if owner.nil?
+
+        owner_class = owner_class_for
+        return nil if owner_class.nil?
+        return owner if owner.is_a?(owner_class)
+        return nil unless owner_association == :account && user?(owner)
+
+        tenant = ActionAgent.tenant_for(owner)
+        tenant if tenant.is_a?(owner_class)
+      end
+
+      private
+
+      def user?(record)
+        user_class = owner_class_for(:user)
+        user_class.present? && record.is_a?(user_class)
       end
     end
 
@@ -88,12 +142,17 @@ module ActionAgent
     end
 
     # Assigns +owner+ to whichever association this install uses. A no-op
-    # when the host app configured no owner model. Writes the foreign key
-    # directly when the association is missing or was declared for another
-    # class, as #owner reads it.
+    # when the host app configured no owner model. The record is resolved as
+    # .for_owner resolves it, so a user handed to an account-owned model
+    # assigns the user's tenant, and an owner that resolves to nothing raises
+    # ArgumentError rather than writing its id into another class's column.
+    # Writes the foreign key directly when the association is missing or was
+    # declared for another class, as #owner reads it.
     def owner=(record)
       association = self.class.owner_association
       return unless association
+
+      record = assignable_owner(record, association)
       return public_send(:"#{association}=", record) if owner_association_current?(association)
 
       self[:"#{association}_id"] = record&.id
@@ -101,6 +160,18 @@ module ActionAgent
 
     private
 
+    def assignable_owner(record, association)
+      return nil if record.nil?
+
+      resolved = self.class.resolve_owner(record)
+      return resolved if resolved
+
+      raise ArgumentError,
+            "#{self.class.name} is owned by #{association} (#{self.class.owner_class_name(association)}), " \
+            "so a #{record.class.name} cannot own it. Assign the #{association} itself, or configure " \
+            "ActionAgent.tenant_resolver to map a user to its account."
+    end
+
     # Whether +association+ was declared for the class the configuration
     # names now.
     def owner_association_current?(association)

data/app/serializers/action_agent/input_request_serializer.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  # The JSON shape of an InputRequest, shared by the JSON API and the MCP
+  # facade. It never includes the request's answer or checkpoint.
+  #
+  # `actor` is the person the paused run executes on behalf of, and
+  # `arguments` the paused call's arguments, for a `confirm` request only.
+  module InputRequestSerializer
+    module_function
+
+    # @param request [InputRequest]
+    # @return [Hash]
+    def call(request)
+      run = request.subject
+      agent = run.try(:agent)
+
+      {
+        id: request.id,
+        kind: request.kind,
+        status: request.status,
+        prompt: request.prompt,
+        options: request.options,
+        answer_schema: request.answer_schema,
+        tool_name: request.tool_name,
+        tool_call_id: request.tool_call_id,
+        arguments: request.kind == "confirm" ? request.arguments : nil,
+        agent: agent && { id: agent.id, name: agent.name, slug: agent.slug },
+        run_id: run.is_a?(AgentRun) ? run.id : nil,
+        actor: actor_json(run.try(:actor)),
+        created_at: request.created_at,
+        expires_at: request.expires_at,
+        answered_at: request.answered_at
+      }
+    end
+
+    def actor_json(actor)
+      return nil if actor.nil?
+
+      {
+        type: actor.class.name,
+        id: actor.try(:id),
+        name: actor.try(:name).presence || actor.try(:email).presence
+      }
+    end
+  end
+end

data/app/serializers/action_agent/scenario_catalog_serializer.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  # JSON for the catalogs API: a catalog's summary for the index, and the
+  # whole tree (products, sets, scenarios) for one catalog.
+  module ScenarioCatalogSerializer
+    module_function
+
+    def summary(catalog)
+      catalog.summary
+    end
+
+    def full(catalog)
+      products = catalog.products.includes(:agent, :project, sets: [ :scenarios, { evaluation: :evaluation_runs } ])
+      catalog.summary.merge(
+        metadata: catalog.metadata,
+        products: products.map do |product|
+          product.summary.merge(sets: product.sets.map { |set| set.summary.merge(scenarios: set.scenarios.map(&:summary)) })
+        end
+      )
+    end
+  end
+end

data/app/serializers/action_agent/session_summary_serializer.rb

@@ -0,0 +1,146 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  # Serializes one page of SessionIndex rows for the Sessions list. What each
+  # row needs from other tables is read once for the page, never per row.
+  #
+  # Every row has `kind` and `id` (which address its timeline), `source`,
+  # `title`, `preview`, `agent`, `outcome` ("failed", "passed" or nil),
+  # `status`, `started_at` and `last_activity_at`, plus what its kind adds.
+  class SessionSummarySerializer
+    OUTCOMES = { "passed" => "passed", "failed" => "failed", "errored" => "failed" }.freeze
+
+    # +rows+ are `{ kind:, record:, time: }` hashes in display order.
+    # +agents+ and +recordings+ are what the caller may see.
+    # +failed_context_ids+ are the conversations among them with a failed run.
+    def initialize(rows, agents:, recordings:, failed_context_ids: [])
+      @rows = rows
+      @agents = agents
+      @recordings = recordings
+      @failed_context_ids = failed_context_ids.to_set
+    end
+
+    # @return [Array<Hash>]
+    def as_json(*)
+      preload
+      @rows.map do |row|
+        case row[:kind]
+        when "context" then context_row(row[:record], row[:time])
+        when "scenario_result" then scenario_result_row(row[:record], row[:time])
+        else recording_row(row[:record], row[:time])
+        end
+      end
+    end
+
+    private
+
+    def records(kind)
+      @rows.select { |row| row[:kind] == kind }.map { |row| row[:record] }
+    end
+
+    def preload
+      contexts = records("context")
+      preloader(contexts, :contextable)
+      preloader(records("scenario_result"), [ :scenario, :agent_run, { evaluation_run: { evaluation: :agent } } ])
+      preloader(records("recording"), agent_run: :agent)
+
+      ids = contexts.map(&:id)
+      @message_counts = ids.empty? ? {} : AgentMessage.where(agent_context_id: ids).group(:agent_context_id).count
+      @recording_counts = recording_counts(ids)
+      @first_inputs = first_user_messages(ids)
+    end
+
+    def preloader(records, associations)
+      ActiveRecord::Associations::Preloader.new(records: records, associations: associations).call if records.any?
+    end
+
+    # How many recordings each conversation replays, found as
+    # SessionTimeline.for_context finds them: linked to the conversation, or
+    # made by a run that wrote a generation to it.
+    def recording_counts(ids)
+      return {} if ids.empty?
+
+      traces = AgentGeneration.where(agent_context_id: ids).where.not(trace_id: [ nil, "" ])
+        .distinct.pluck(:trace_id, :agent_context_id)
+      contexts_by_trace = traces.group_by(&:first).transform_values { |pairs| pairs.map(&:last) }
+      contexts_by_run = AgentRun.where(agent: @agents, trace_id: contexts_by_trace.keys).pluck(:id, :trace_id)
+        .to_h { |run_id, trace_id| [ run_id, contexts_by_trace.fetch(trace_id) ] }
+
+      found = @recordings.where(agent_context_id: ids).or(@recordings.where(agent_run_id: contexts_by_run.keys))
+        .pluck(:id, :agent_context_id, :agent_run_id)
+      recordings = Hash.new { |sets, context_id| sets[context_id] = Set.new }
+      found.each do |id, context_id, run_id|
+        ([ context_id, *contexts_by_run.fetch(run_id, []) ] & ids).each { |owner| recordings[owner] << id }
+      end
+      recordings.transform_values(&:size)
+    end
+
+    # What each conversation was first asked. Messages are only appended, so
+    # the smallest id is the first.
+    def first_user_messages(ids)
+      return {} if ids.empty?
+
+      first_ids = AgentMessage.where(agent_context_id: ids, role: "user").where.not(content: [ nil, "" ])
+        .group(:agent_context_id).minimum(:id)
+      AgentMessage.where(id: first_ids.values).pluck(:agent_context_id, :content).to_h
+    end
+
+    def context_row(context, time)
+      agent = context.contextable.is_a?(Agent) ? context.contextable : nil
+      common("context", context, time).merge(
+        title: "#{context.agent_name}##{context.action_name}",
+        preview: InteractionPreview.line(@first_inputs[context.id]),
+        agent: agent_json(agent),
+        outcome: @failed_context_ids.include?(context.id) ? "failed" : nil,
+        status: nil,
+        message_count: @message_counts[context.id] || 0,
+        recording_count: @recording_counts[context.id] || 0,
+        started_at: timestamp(context.created_at)
+      )
+    end
+
+    def scenario_result_row(result, time)
+      scenario = result.evaluated_scenario
+      evaluation = result.evaluation_run.evaluation
+      common("scenario_result", result, time).merge(
+        title: scenario["key"].presence || "Scenario #{result.evaluation_scenario_id}",
+        preview: InteractionPreview.line(scenario["prompt"]),
+        agent: agent_json(evaluation.agent),
+        outcome: OUTCOMES[result.status],
+        status: result.status,
+        model: result.model,
+        evaluation: { id: evaluation.id, name: evaluation.name, run_id: result.evaluation_run_id },
+        agent_run_id: result.agent_run_id,
+        started_at: timestamp(result.agent_run&.started_at || result.created_at)
+      )
+    end
+
+    def recording_row(recording, time)
+      run = recording.agent_run
+      common("recording", recording, time).merge(
+        title: recording.name.presence || "Recording #{recording.id}",
+        preview: nil,
+        agent: agent_json(run&.agent),
+        outcome: recording.failed? || run&.failed? ? "failed" : nil,
+        status: recording.status,
+        recording_source: recording.source,
+        event_count: recording.event_count,
+        action_count: recording.action_count,
+        agent_run_id: recording.agent_run_id,
+        started_at: timestamp(recording.created_at)
+      )
+    end
+
+    def common(kind, record, time)
+      { kind: kind, id: record.id, source: SessionIndex::KINDS.fetch(kind), last_activity_at: timestamp(time) }
+    end
+
+    def agent_json(agent)
+      agent && { id: agent.id, name: agent.name, slug: agent.slug }
+    end
+
+    def timestamp(time)
+      time&.utc&.iso8601(3)
+    end
+  end
+end