django-agent-studio 0.1.0__py3-none-any.whl

django_agent_studio/api/views.py

@@ -0,0 +1,1548 @@
+"""
+API views for django_agent_studio.
+"""
+
+from django.db import models
+from django.http import Http404
+from django.shortcuts import get_object_or_404
+from django.utils import timezone
+from rest_framework import generics, status
+from rest_framework.permissions import IsAuthenticated
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+from django_agent_runtime.models import (
+    AgentDefinition,
+    AgentVersion,
+    AgentTool,
+    AgentKnowledge,
+    DiscoveredFunction,
+    DynamicTool,
+    DynamicToolExecution,
+    # Multi-agent system models
+    AgentSystem,
+    AgentSystemMember,
+    AgentSystemVersion,
+    AgentSystemSnapshot,
+)
+from django_agent_studio.api.serializers import (
+    AgentDefinitionListSerializer,
+    AgentDefinitionDetailSerializer,
+    AgentVersionSerializer,
+    AgentToolSerializer,
+    AgentKnowledgeSerializer,
+    DiscoveredFunctionSerializer,
+    DynamicToolSerializer,
+    DynamicToolExecutionSerializer,
+    ProjectScanRequestSerializer,
+    GenerateToolsRequestSerializer,
+)
+
+
+# =============================================================================
+# Helper functions for consistent access control
+# =============================================================================
+
+def get_agent_for_user(user, agent_id):
+    """
+    Get an agent if the user has access.
+
+    - Superusers can access any agent
+    - Regular users can only access their own agents
+    """
+    if user.is_superuser:
+        return get_object_or_404(AgentDefinition, id=agent_id)
+    return get_object_or_404(AgentDefinition, id=agent_id, owner=user)
+
+
+def get_agent_queryset_for_user(user):
+    """
+    Get queryset of agents accessible to the user.
+
+    - Superusers can see all agents
+    - Regular users see only their own agents
+    """
+    if user.is_superuser:
+        return AgentDefinition.objects.all()
+    return AgentDefinition.objects.filter(owner=user)
+
+
+def get_system_for_user(user, system_id):
+    """
+    Get a system if the user has access.
+
+    - Superusers can access any system
+    - Regular users can only access their own systems
+    """
+    if user.is_superuser:
+        return get_object_or_404(AgentSystem, id=system_id)
+    return get_object_or_404(AgentSystem, id=system_id, owner=user)
+
+
+def get_system_queryset_for_user(user):
+    """
+    Get queryset of systems accessible to the user.
+
+    - Superusers can see all systems
+    - Regular users see only their own systems
+    """
+    if user.is_superuser:
+        return AgentSystem.objects.all()
+    return AgentSystem.objects.filter(owner=user)
+
+
+class AgentDefinitionListCreateView(generics.ListCreateAPIView):
+    """List and create agent definitions."""
+
+    permission_classes = [IsAuthenticated]
+    serializer_class = AgentDefinitionListSerializer
+
+    def get_queryset(self):
+        return get_agent_queryset_for_user(self.request.user)
+
+    def perform_create(self, serializer):
+        agent = serializer.save(owner=self.request.user)
+        # Create initial draft version
+        AgentVersion.objects.create(
+            agent=agent,
+            version="draft",
+            is_draft=True,
+            is_active=True,
+        )
+
+
+class AgentDefinitionDetailView(generics.RetrieveUpdateDestroyAPIView):
+    """Retrieve, update, or delete an agent definition."""
+
+    permission_classes = [IsAuthenticated]
+    serializer_class = AgentDefinitionDetailSerializer
+
+    def get_queryset(self):
+        return get_agent_queryset_for_user(self.request.user)
+
+
+class AgentVersionListCreateView(generics.ListCreateAPIView):
+    """List and create versions for an agent."""
+
+    permission_classes = [IsAuthenticated]
+    serializer_class = AgentVersionSerializer
+
+    def get_queryset(self):
+        agent = get_agent_for_user(self.request.user, self.kwargs["agent_id"])
+        return agent.versions.all()
+
+    def perform_create(self, serializer):
+        agent = get_agent_for_user(self.request.user, self.kwargs["agent_id"])
+        serializer.save(agent=agent)
+
+
+class AgentVersionDetailView(generics.RetrieveUpdateDestroyAPIView):
+    """Retrieve, update, or delete an agent version."""
+
+    permission_classes = [IsAuthenticated]
+    serializer_class = AgentVersionSerializer
+
+    def get_queryset(self):
+        agent = get_agent_for_user(self.request.user, self.kwargs["agent_id"])
+        return agent.versions.all()
+
+
+class AgentVersionActivateView(APIView):
+    """Activate a specific version of an agent."""
+
+    permission_classes = [IsAuthenticated]
+
+    def post(self, request, agent_id, pk):
+        agent = get_agent_for_user(request.user, agent_id)
+        version = get_object_or_404(agent.versions, id=pk)
+
+        # Deactivate all other versions
+        agent.versions.update(is_active=False)
+
+        # Activate this version
+        version.is_active = True
+        version.is_draft = False
+        version.published_at = timezone.now()
+        version.save()
+
+        return Response(AgentVersionSerializer(version).data)
+
+
+class AgentToolListCreateView(generics.ListCreateAPIView):
+    """List and create tools for an agent."""
+
+    permission_classes = [IsAuthenticated]
+    serializer_class = AgentToolSerializer
+
+    def get_queryset(self):
+        agent = get_agent_for_user(self.request.user, self.kwargs["agent_id"])
+        return agent.tools.all()
+
+    def perform_create(self, serializer):
+        agent = get_agent_for_user(self.request.user, self.kwargs["agent_id"])
+        serializer.save(agent=agent)
+
+
+class AgentToolDetailView(generics.RetrieveUpdateDestroyAPIView):
+    """Retrieve, update, or delete an agent tool."""
+
+    permission_classes = [IsAuthenticated]
+    serializer_class = AgentToolSerializer
+
+    def get_queryset(self):
+        agent = get_agent_for_user(self.request.user, self.kwargs["agent_id"])
+        return agent.tools.all()
+
+
+class AgentKnowledgeListCreateView(generics.ListCreateAPIView):
+    """List and create knowledge sources for an agent."""
+
+    permission_classes = [IsAuthenticated]
+    serializer_class = AgentKnowledgeSerializer
+
+    def get_queryset(self):
+        agent = get_agent_for_user(self.request.user, self.kwargs["agent_id"])
+        return agent.knowledge_sources.all()
+
+    def perform_create(self, serializer):
+        agent = get_agent_for_user(self.request.user, self.kwargs["agent_id"])
+        serializer.save(agent=agent)
+
+
+class AgentKnowledgeDetailView(generics.RetrieveUpdateDestroyAPIView):
+    """Retrieve, update, or delete an agent knowledge source."""
+
+    permission_classes = [IsAuthenticated]
+    serializer_class = AgentKnowledgeSerializer
+
+    def get_queryset(self):
+        agent = get_agent_for_user(self.request.user, self.kwargs["agent_id"])
+        return agent.knowledge_sources.all()
+
+
+class TemplateAgentListView(generics.ListAPIView):
+    """List public template agents."""
+
+    permission_classes = [IsAuthenticated]
+    serializer_class = AgentDefinitionListSerializer
+
+    def get_queryset(self):
+        return AgentDefinition.objects.filter(
+            is_template=True,
+            is_public=True,
+            is_active=True,
+        )
+
+
+class AgentForkView(APIView):
+    """Fork an agent (create a copy with the current user as owner)."""
+
+    permission_classes = [IsAuthenticated]
+
+    def post(self, request, pk):
+        # Get the source agent (must be public template, owned by user, or superuser)
+        if request.user.is_superuser:
+            source = get_object_or_404(AgentDefinition, id=pk)
+        else:
+            source = get_object_or_404(
+                AgentDefinition.objects.filter(
+                    models.Q(owner=request.user) |
+                    models.Q(is_template=True, is_public=True)
+                ),
+                id=pk,
+            )
+
+        # Create a copy
+        new_agent = AgentDefinition.objects.create(
+            name=f"{source.name} (Copy)",
+            slug=f"{source.slug}-copy-{timezone.now().strftime('%Y%m%d%H%M%S')}",
+            description=source.description,
+            icon=source.icon,
+            parent=source if source.is_template else source.parent,
+            owner=request.user,
+            is_public=False,
+            is_template=False,
+        )
+
+        # Copy the active version
+        source_version = source.versions.filter(is_active=True).first()
+        if source_version:
+            AgentVersion.objects.create(
+                agent=new_agent,
+                version="draft",
+                system_prompt=source_version.system_prompt,
+                model=source_version.model,
+                model_settings=source_version.model_settings,
+                extra_config=source_version.extra_config,
+                is_draft=True,
+                is_active=True,
+            )
+
+        # Copy tools
+        for tool in source.tools.filter(is_active=True):
+            AgentTool.objects.create(
+                agent=new_agent,
+                name=tool.name,
+                tool_type=tool.tool_type,
+                description=tool.description,
+                parameters_schema=tool.parameters_schema,
+                builtin_ref=tool.builtin_ref,
+                subagent=tool.subagent,
+                config=tool.config,
+                order=tool.order,
+            )
+
+        # Copy knowledge (except files - those need to be re-uploaded)
+        for knowledge in source.knowledge_sources.filter(is_active=True):
+            AgentKnowledge.objects.create(
+                agent=new_agent,
+                name=knowledge.name,
+                knowledge_type=knowledge.knowledge_type,
+                content=knowledge.content,
+                url=knowledge.url,
+                dynamic_config=knowledge.dynamic_config,
+                inclusion_mode=knowledge.inclusion_mode,
+                order=knowledge.order,
+            )
+
+        return Response(
+            AgentDefinitionDetailSerializer(new_agent).data,
+            status=status.HTTP_201_CREATED,
+        )
+
+
+# =============================================================================
+# Dynamic Tool Discovery Views
+# =============================================================================
+
+from django_agent_studio.api.permissions import (
+    CanViewDynamicTools,
+    CanScanProject,
+    CanRequestTool,
+    CanCreateTool,
+    CanApproveTool,
+    CanManagePermissions,
+    DynamicToolObjectPermission,
+    IsOwnerOrHasDynamicToolAccess,
+)
+from django_agent_studio.services.permissions import get_permission_service
+
+
+class ProjectScanView(APIView):
+    """
+    Scan the Django project to discover functions.
+
+    POST /api/agents/{id}/scan-project/
+
+    Requires: Scanner access level or agent ownership
+    """
+
+    permission_classes = [IsAuthenticated, CanScanProject | IsOwnerOrHasDynamicToolAccess]
+
+    def post(self, request, agent_id):
+        agent = get_object_or_404(AgentDefinition, id=agent_id)
+
+        serializer = ProjectScanRequestSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+
+        from django_agent_runtime.dynamic_tools import ProjectScanner
+
+        # Create scanner with options
+        scanner = ProjectScanner(
+            include_private=serializer.validated_data.get('include_private', False),
+            include_tests=serializer.validated_data.get('include_tests', False),
+            app_filter=serializer.validated_data.get('app_filter'),
+        )
+
+        # Scan project or specific directory
+        directory = serializer.validated_data.get('directory')
+        if directory:
+            functions = scanner.scan_directory(directory)
+        else:
+            functions = scanner.scan()
+
+        # Store discovered functions
+        scan_session = scanner.scan_session
+        created_functions = []
+
+        for func_info in functions:
+            discovered, created = DiscoveredFunction.objects.update_or_create(
+                function_path=func_info.function_path,
+                scan_session=scan_session,
+                defaults={
+                    'name': func_info.name,
+                    'module_path': func_info.module_path,
+                    'function_type': func_info.function_type,
+                    'class_name': func_info.class_name,
+                    'file_path': func_info.file_path,
+                    'line_number': func_info.line_number,
+                    'signature': func_info.signature,
+                    'docstring': func_info.docstring,
+                    'parameters': func_info.parameters,
+                    'return_type': func_info.return_type,
+                    'is_async': func_info.is_async,
+                    'has_side_effects': func_info.has_side_effects,
+                    'is_private': func_info.is_private,
+                }
+            )
+            created_functions.append(discovered)
+
+        return Response({
+            'scan_session': scan_session,
+            'functions_discovered': len(created_functions),
+            'functions': DiscoveredFunctionSerializer(created_functions, many=True).data,
+        })
+
+
+class DiscoveredFunctionListView(generics.ListAPIView):
+    """
+    List discovered functions from project scans.
+
+    GET /api/discovered-functions/
+
+    Requires: Viewer access level
+    """
+
+    permission_classes = [IsAuthenticated, CanViewDynamicTools]
+    serializer_class = DiscoveredFunctionSerializer
+
+    def get_queryset(self):
+        queryset = DiscoveredFunction.objects.all()
+
+        # Filter by scan session
+        scan_session = self.request.query_params.get('scan_session')
+        if scan_session:
+            queryset = queryset.filter(scan_session=scan_session)
+
+        # Filter by function type
+        function_type = self.request.query_params.get('function_type')
+        if function_type:
+            queryset = queryset.filter(function_type=function_type)
+
+        # Filter by selected status
+        is_selected = self.request.query_params.get('is_selected')
+        if is_selected is not None:
+            queryset = queryset.filter(is_selected=is_selected.lower() == 'true')
+
+        return queryset
+
+
+class GenerateToolsView(APIView):
+    """
+    Generate dynamic tools from discovered functions.
+
+    POST /api/agents/{id}/generate-tools/
+
+    Requires:
+    - Creator access: creates tools directly
+    - Requester access: creates approval requests instead
+    - Owner: creates tools directly
+    """
+
+    permission_classes = [IsAuthenticated, CanRequestTool | IsOwnerOrHasDynamicToolAccess]
+
+    def post(self, request, agent_id):
+        agent = get_object_or_404(AgentDefinition, id=agent_id)
+
+        # Check if user can create directly or needs approval
+        perm_service = get_permission_service()
+        can_create_directly = (
+            agent.owner == request.user or
+            perm_service.can_create_tool(request.user, agent)
+        )
+
+        serializer = GenerateToolsRequestSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+
+        from django_agent_runtime.dynamic_tools import ToolGenerator
+
+        # Get discovered functions
+        function_ids = serializer.validated_data['function_ids']
+        functions = DiscoveredFunction.objects.filter(id__in=function_ids)
+
+        if not functions.exists():
+            return Response(
+                {'error': 'No functions found with the provided IDs'},
+                status=status.HTTP_404_NOT_FOUND,
+            )
+
+        # Create generator
+        generator = ToolGenerator(
+            default_requires_confirmation=serializer.validated_data.get(
+                'requires_confirmation', True
+            ),
+            name_prefix=serializer.validated_data.get('name_prefix', ''),
+        )
+
+        if can_create_directly:
+            # Create tools directly
+            return self._create_tools_directly(
+                request, agent, functions, generator, serializer
+            )
+        else:
+            # Create approval requests
+            return self._create_approval_requests(
+                request, agent, functions, generator, serializer
+            )
+
+    def _create_tools_directly(self, request, agent, functions, generator, serializer):
+        """Create tools directly (for owners and creators)."""
+        from django_agent_runtime.dynamic_tools.scanner import FunctionInfo
+
+        created_tools = []
+        for discovered in functions:
+            func_info = FunctionInfo(
+                name=discovered.name,
+                module_path=discovered.module_path,
+                function_path=discovered.function_path,
+                function_type=discovered.function_type,
+                file_path=discovered.file_path,
+                line_number=discovered.line_number,
+                signature=discovered.signature,
+                docstring=discovered.docstring,
+                class_name=discovered.class_name,
+                parameters=discovered.parameters,
+                return_type=discovered.return_type,
+                is_async=discovered.is_async,
+                has_side_effects=discovered.has_side_effects,
+                is_private=discovered.is_private,
+            )
+
+            schema = generator.generate(func_info)
+
+            tool, created = DynamicTool.objects.update_or_create(
+                agent=agent,
+                function_path=schema.function_path,
+                defaults={
+                    'name': schema.name,
+                    'description': schema.description,
+                    'parameters_schema': schema.parameters_schema,
+                    'source_file': schema.source_file,
+                    'source_line': schema.source_line,
+                    'is_safe': schema.is_safe,
+                    'requires_confirmation': schema.requires_confirmation,
+                    'discovered_function': discovered,
+                    'created_by': request.user,
+                }
+            )
+
+            discovered.is_selected = True
+            discovered.save(update_fields=['is_selected'])
+            created_tools.append(tool)
+
+        return Response({
+            'tools_created': len(created_tools),
+            'tools': DynamicToolSerializer(created_tools, many=True).data,
+        }, status=status.HTTP_201_CREATED)
+
+    def _create_approval_requests(self, request, agent, functions, generator, serializer):
+        """Create approval requests (for requesters)."""
+        from django_agent_runtime.dynamic_tools.scanner import FunctionInfo
+        from django_agent_studio.models import ToolApprovalRequest
+        from django_agent_studio.api.serializers import ToolApprovalRequestSerializer
+
+        created_requests = []
+        for discovered in functions:
+            func_info = FunctionInfo(
+                name=discovered.name,
+                module_path=discovered.module_path,
+                function_path=discovered.function_path,
+                function_type=discovered.function_type,
+                file_path=discovered.file_path,
+                line_number=discovered.line_number,
+                signature=discovered.signature,
+                docstring=discovered.docstring,
+                class_name=discovered.class_name,
+                parameters=discovered.parameters,
+                return_type=discovered.return_type,
+                is_async=discovered.is_async,
+                has_side_effects=discovered.has_side_effects,
+                is_private=discovered.is_private,
+            )
+
+            schema = generator.generate(func_info)
+
+            approval_request = ToolApprovalRequest.objects.create(
+                agent=agent,
+                discovered_function=discovered,
+                proposed_name=schema.name,
+                proposed_description=schema.description,
+                proposed_is_safe=schema.is_safe,
+                proposed_requires_confirmation=schema.requires_confirmation,
+                proposed_timeout_seconds=30,
+                requester=request.user,
+                request_reason=serializer.validated_data.get('request_reason', ''),
+            )
+            created_requests.append(approval_request)
+
+        return Response({
+            'approval_required': True,
+            'requests_created': len(created_requests),
+            'requests': ToolApprovalRequestSerializer(created_requests, many=True).data,
+        }, status=status.HTTP_202_ACCEPTED)
+
+
+class DynamicToolListView(generics.ListAPIView):
+    """
+    List dynamic tools for an agent.
+
+    GET /api/agents/{id}/dynamic-tools/
+
+    Requires: Viewer access or agent ownership
+    """
+
+    permission_classes = [IsAuthenticated, CanViewDynamicTools | IsOwnerOrHasDynamicToolAccess]
+    serializer_class = DynamicToolSerializer
+
+    def get_queryset(self):
+        agent = get_object_or_404(AgentDefinition, id=self.kwargs["agent_id"])
+        return agent.dynamic_tools.all()
+
+
+class DynamicToolDetailView(generics.RetrieveUpdateDestroyAPIView):
+    """
+    Retrieve, update, or delete a dynamic tool.
+
+    GET/PUT/PATCH/DELETE /api/agents/{id}/dynamic-tools/{tool_id}/
+
+    Requires:
+    - GET: Viewer access or ownership
+    - PUT/PATCH: Creator access or ownership
+    - DELETE: Admin access or ownership
+    """
+
+    permission_classes = [IsAuthenticated, DynamicToolObjectPermission | IsOwnerOrHasDynamicToolAccess]
+    serializer_class = DynamicToolSerializer
+
+    def get_queryset(self):
+        agent = get_object_or_404(AgentDefinition, id=self.kwargs["agent_id"])
+        return agent.dynamic_tools.all()
+
+
+class DynamicToolToggleView(APIView):
+    """
+    Toggle a dynamic tool's active status.
+
+    POST /api/agents/{id}/dynamic-tools/{tool_id}/toggle/
+
+    Requires: Creator access or ownership
+    """
+
+    permission_classes = [IsAuthenticated, CanCreateTool | IsOwnerOrHasDynamicToolAccess]
+
+    def post(self, request, agent_id, tool_id):
+        agent = get_object_or_404(AgentDefinition, id=agent_id)
+        tool = get_object_or_404(agent.dynamic_tools, id=tool_id)
+
+        tool.is_active = not tool.is_active
+        tool.save(update_fields=['is_active'])
+
+        return Response(DynamicToolSerializer(tool).data)
+
+
+class DynamicToolExecutionListView(generics.ListAPIView):
+    """
+    List executions for a dynamic tool.
+
+    GET /api/agents/{id}/dynamic-tools/{tool_id}/executions/
+
+    Requires: Viewer access or ownership
+    """
+
+    permission_classes = [IsAuthenticated, CanViewDynamicTools | IsOwnerOrHasDynamicToolAccess]
+    serializer_class = DynamicToolExecutionSerializer
+
+    def get_queryset(self):
+        agent = get_object_or_404(AgentDefinition, id=self.kwargs["agent_id"])
+        tool = get_object_or_404(agent.dynamic_tools, id=self.kwargs["tool_id"])
+        return tool.executions.all()
+
+
+# =============================================================================
+# Approval Workflow Views
+# =============================================================================
+
+from django_agent_studio.models import ToolApprovalRequest, UserDynamicToolAccess
+from django_agent_studio.api.serializers import (
+    ToolApprovalRequestSerializer,
+    ToolApprovalReviewSerializer,
+    UserDynamicToolAccessSerializer,
+    GrantAccessSerializer,
+)
+
+
+class ToolApprovalRequestListView(generics.ListAPIView):
+    """
+    List tool approval requests.
+
+    GET /api/tool-approval-requests/
+
+    - Admins see all pending requests
+    - Requesters see their own requests
+    """
+
+    permission_classes = [IsAuthenticated, CanRequestTool]
+    serializer_class = ToolApprovalRequestSerializer
+
+    def get_queryset(self):
+        perm_service = get_permission_service()
+
+        # Admins see all, others see only their own
+        if perm_service.can_approve(self.request.user):
+            queryset = ToolApprovalRequest.objects.all()
+        else:
+            queryset = ToolApprovalRequest.objects.filter(requester=self.request.user)
+
+        # Filter by status
+        status_filter = self.request.query_params.get('status')
+        if status_filter:
+            queryset = queryset.filter(status=status_filter)
+
+        # Filter by agent
+        agent_id = self.request.query_params.get('agent_id')
+        if agent_id:
+            queryset = queryset.filter(agent_id=agent_id)
+
+        return queryset
+
+
+class ToolApprovalRequestDetailView(generics.RetrieveAPIView):
+    """
+    Retrieve a tool approval request.
+
+    GET /api/tool-approval-requests/{id}/
+    """
+
+    permission_classes = [IsAuthenticated, CanRequestTool]
+    serializer_class = ToolApprovalRequestSerializer
+
+    def get_queryset(self):
+        perm_service = get_permission_service()
+
+        if perm_service.can_approve(self.request.user):
+            return ToolApprovalRequest.objects.all()
+        return ToolApprovalRequest.objects.filter(requester=self.request.user)
+
+
+class ToolApprovalReviewView(APIView):
+    """
+    Review (approve/reject) a tool approval request.
+
+    POST /api/tool-approval-requests/{id}/review/
+
+    Requires: Admin access
+    """
+
+    permission_classes = [IsAuthenticated, CanApproveTool]
+
+    def post(self, request, pk):
+        approval_request = get_object_or_404(ToolApprovalRequest, id=pk)
+
+        if approval_request.status != ToolApprovalRequest.Status.PENDING:
+            return Response(
+                {'error': f'Request is already {approval_request.get_status_display()}'},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        serializer = ToolApprovalReviewSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+
+        action = serializer.validated_data['action']
+        review_notes = serializer.validated_data.get('review_notes', '')
+
+        approval_request.reviewed_by = request.user
+        approval_request.reviewed_at = timezone.now()
+        approval_request.review_notes = review_notes
+
+        if action == 'approve':
+            return self._approve_request(approval_request, serializer.validated_data)
+        else:
+            return self._reject_request(approval_request)
+
+    def _approve_request(self, approval_request, validated_data):
+        """Approve the request and create the tool."""
+        # Use overrides if provided, otherwise use proposed values
+        name = validated_data.get('override_name', approval_request.proposed_name)
+        description = validated_data.get(
+            'override_description', approval_request.proposed_description
+        )
+        is_safe = validated_data.get('override_is_safe', approval_request.proposed_is_safe)
+        requires_confirmation = validated_data.get(
+            'override_requires_confirmation',
+            approval_request.proposed_requires_confirmation
+        )
+        timeout = validated_data.get(
+            'override_timeout_seconds',
+            approval_request.proposed_timeout_seconds
+        )
+
+        # Create the tool
+        tool = DynamicTool.objects.create(
+            agent=approval_request.agent,
+            name=name,
+            description=description,
+            function_path=approval_request.discovered_function.function_path,
+            source_file=approval_request.discovered_function.file_path,
+            source_line=approval_request.discovered_function.line_number,
+            parameters_schema=self._build_parameters_schema(
+                approval_request.discovered_function
+            ),
+            is_safe=is_safe,
+            requires_confirmation=requires_confirmation,
+            timeout_seconds=timeout,
+            discovered_function=approval_request.discovered_function,
+            created_by=approval_request.requester,
+            is_verified=True,  # Admin-approved tools are verified
+        )
+
+        # Update request
+        approval_request.status = ToolApprovalRequest.Status.APPROVED
+        approval_request.created_tool = tool
+        approval_request.save()
+
+        # Mark function as selected
+        approval_request.discovered_function.is_selected = True
+        approval_request.discovered_function.save(update_fields=['is_selected'])
+
+        return Response({
+            'status': 'approved',
+            'tool': DynamicToolSerializer(tool).data,
+            'request': ToolApprovalRequestSerializer(approval_request).data,
+        })
+
+    def _reject_request(self, approval_request):
+        """Reject the request."""
+        approval_request.status = ToolApprovalRequest.Status.REJECTED
+        approval_request.save()
+
+        return Response({
+            'status': 'rejected',
+            'request': ToolApprovalRequestSerializer(approval_request).data,
+        })
+
+    def _build_parameters_schema(self, discovered_function):
+        """Build JSON Schema from discovered function parameters."""
+        from django_agent_runtime.dynamic_tools import ToolGenerator
+        from django_agent_runtime.dynamic_tools.scanner import FunctionInfo
+
+        func_info = FunctionInfo(
+            name=discovered_function.name,
+            module_path=discovered_function.module_path,
+            function_path=discovered_function.function_path,
+            function_type=discovered_function.function_type,
+            file_path=discovered_function.file_path,
+            line_number=discovered_function.line_number,
+            signature=discovered_function.signature,
+            docstring=discovered_function.docstring,
+            class_name=discovered_function.class_name,
+            parameters=discovered_function.parameters,
+            return_type=discovered_function.return_type,
+            is_async=discovered_function.is_async,
+            has_side_effects=discovered_function.has_side_effects,
+            is_private=discovered_function.is_private,
+        )
+
+        generator = ToolGenerator()
+        schema = generator.generate(func_info)
+        return schema.parameters_schema
+
+
+class ToolApprovalCancelView(APIView):
+    """
+    Cancel a pending tool approval request.
+
+    POST /api/tool-approval-requests/{id}/cancel/
+
+    Only the requester can cancel their own request.
+    """
+
+    permission_classes = [IsAuthenticated]
+
+    def post(self, request, pk):
+        approval_request = get_object_or_404(
+            ToolApprovalRequest,
+            id=pk,
+            requester=request.user,
+        )
+
+        if approval_request.status != ToolApprovalRequest.Status.PENDING:
+            return Response(
+                {'error': f'Request is already {approval_request.get_status_display()}'},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        approval_request.status = ToolApprovalRequest.Status.CANCELLED
+        approval_request.save()
+
+        return Response({
+            'status': 'cancelled',
+            'request': ToolApprovalRequestSerializer(approval_request).data,
+        })
+
+
+
+# =============================================================================
+# Permission Management Views
+# =============================================================================
+
+
+class UserAccessListView(generics.ListAPIView):
+    """
+    List all user access grants.
+
+    GET /api/dynamic-tool-access/
+
+    Requires: Admin access
+    """
+
+    permission_classes = [IsAuthenticated, CanManagePermissions]
+    serializer_class = UserDynamicToolAccessSerializer
+    queryset = UserDynamicToolAccess.objects.all()
+
+
+class UserAccessDetailView(generics.RetrieveUpdateDestroyAPIView):
+    """
+    Retrieve, update, or delete a user's access.
+
+    GET/PUT/PATCH/DELETE /api/dynamic-tool-access/{id}/
+
+    Requires: Admin access
+    """
+
+    permission_classes = [IsAuthenticated, CanManagePermissions]
+    serializer_class = UserDynamicToolAccessSerializer
+    queryset = UserDynamicToolAccess.objects.all()
+
+
+class GrantAccessView(APIView):
+    """
+    Grant dynamic tool access to a user.
+
+    POST /api/dynamic-tool-access/grant/
+
+    Requires: Admin access
+    """
+
+    permission_classes = [IsAuthenticated, CanManagePermissions]
+
+    def post(self, request):
+        serializer = GrantAccessSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+
+        from django.contrib.auth import get_user_model
+        User = get_user_model()
+
+        try:
+            user = User.objects.get(id=serializer.validated_data['user_id'])
+        except User.DoesNotExist:
+            return Response(
+                {'error': 'User not found'},
+                status=status.HTTP_404_NOT_FOUND,
+            )
+
+        # Get agents if restricted
+        agents = None
+        agent_ids = serializer.validated_data.get('restricted_to_agent_ids')
+        if agent_ids:
+            agents = AgentDefinition.objects.filter(id__in=agent_ids)
+
+        perm_service = get_permission_service()
+        access = perm_service.grant_access(
+            user=user,
+            access_level=serializer.validated_data['access_level'],
+            granted_by=request.user,
+            agents=agents,
+            notes=serializer.validated_data.get('notes', ''),
+        )
+
+        return Response(
+            UserDynamicToolAccessSerializer(access).data,
+            status=status.HTTP_201_CREATED,
+        )
+
+
+class RevokeAccessView(APIView):
+    """
+    Revoke dynamic tool access from a user.
+
+    POST /api/dynamic-tool-access/revoke/
+
+    Requires: Admin access
+    """
+
+    permission_classes = [IsAuthenticated, CanManagePermissions]
+
+    def post(self, request):
+        user_id = request.data.get('user_id')
+        if not user_id:
+            return Response(
+                {'error': 'user_id is required'},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        from django.contrib.auth import get_user_model
+        User = get_user_model()
+
+        try:
+            user = User.objects.get(id=user_id)
+        except User.DoesNotExist:
+            return Response(
+                {'error': 'User not found'},
+                status=status.HTTP_404_NOT_FOUND,
+            )
+
+        perm_service = get_permission_service()
+        revoked = perm_service.revoke_access(user)
+
+        if revoked:
+            return Response({'status': 'revoked'})
+        return Response(
+            {'status': 'no_access', 'message': 'User had no access to revoke'},
+        )
+
+
+class MyAccessView(APIView):
+    """
+    Get the current user's dynamic tool access level.
+
+    GET /api/dynamic-tool-access/me/
+    """
+
+    permission_classes = [IsAuthenticated]
+
+    def get(self, request):
+        perm_service = get_permission_service()
+        access_level = perm_service.get_user_access_level(request.user)
+
+        # Get the access record if it exists
+        try:
+            access = UserDynamicToolAccess.objects.get(user=request.user)
+            return Response({
+                'access_level': access_level,
+                'access_level_display': access.get_access_level_display(),
+                'restricted_to_agents': [
+                    {'id': str(a.id), 'name': a.name}
+                    for a in access.restricted_to_agents.all()
+                ],
+                'granted_at': access.granted_at,
+            })
+        except UserDynamicToolAccess.DoesNotExist:
+            # User has no explicit access (defaults to NONE unless superuser)
+            from django_agent_studio.models.permissions import DynamicToolAccessLevel
+            return Response({
+                'access_level': access_level,
+                'access_level_display': (
+                    'Admin (superuser)' if request.user.is_superuser
+                    else DynamicToolAccessLevel(access_level).label
+                ),
+                'restricted_to_agents': [],
+                'granted_at': None,
+            })
+
+
+class ModelsListView(APIView):
+    """List available LLM models for the model selector."""
+
+    permission_classes = [IsAuthenticated]
+
+    def get(self, request):
+        from django_agent_runtime.runtime.llm import list_models_for_ui, DEFAULT_MODEL
+
+        models = list_models_for_ui()
+        return Response({
+            "models": models,
+            "default": DEFAULT_MODEL,
+        })
+
+
+# =============================================================================
+# Agent Schema Editor Views
+# =============================================================================
+
+
+class AgentFullSchemaView(APIView):
+    """
+    Get or update the complete agent schema for debugging/editing.
+
+    GET /api/agents/{id}/full-schema/
+    Returns the complete agent configuration including all tools, knowledge,
+    dynamic tools, discovered functions, RAG config, etc.
+
+    PUT /api/agents/{id}/full-schema/
+    Updates the agent configuration from a full schema JSON.
+    """
+
+    permission_classes = [IsAuthenticated]
+
+    def get(self, request, pk):
+        """Get the complete agent schema."""
+        agent = get_agent_for_user(request.user, pk)
+
+        # Get active version
+        active_version = agent.versions.filter(is_active=True).first()
+
+        # Build comprehensive schema
+        schema = {
+            # Metadata
+            "id": str(agent.id),
+            "slug": agent.slug,
+            "name": agent.name,
+            "description": agent.description,
+            "icon": agent.icon,
+            "is_public": agent.is_public,
+            "is_template": agent.is_template,
+            "is_active": agent.is_active,
+            "created_at": agent.created_at.isoformat() if agent.created_at else None,
+            "updated_at": agent.updated_at.isoformat() if agent.updated_at else None,
+
+            # Parent agent (for inheritance)
+            "parent": {
+                "id": str(agent.parent.id),
+                "slug": agent.parent.slug,
+                "name": agent.parent.name,
+            } if agent.parent else None,
+
+            # Active version configuration
+            "version": {
+                "id": str(active_version.id) if active_version else None,
+                "version": active_version.version if active_version else "draft",
+                "system_prompt": active_version.system_prompt if active_version else "",
+                "model": active_version.model if active_version else "gpt-4o",
+                "model_settings": active_version.model_settings if active_version else {},
+                "extra_config": active_version.extra_config if active_version else {},
+                "is_draft": active_version.is_draft if active_version else True,
+                "is_active": active_version.is_active if active_version else False,
+                "notes": active_version.notes if active_version else "",
+            },
+
+            # RAG configuration
+            "rag_config": agent.rag_config or {
+                "enabled": False,
+                "top_k": 5,
+                "similarity_threshold": 0.7,
+                "chunk_size": 500,
+                "chunk_overlap": 50,
+                "embedding_model": "text-embedding-3-small",
+            },
+
+            # Static tools (AgentTool)
+            "tools": [
+                {
+                    "id": str(tool.id),
+                    "name": tool.name,
+                    "tool_type": tool.tool_type,
+                    "description": tool.description,
+                    "parameters_schema": tool.parameters_schema,
+                    "builtin_ref": tool.builtin_ref,
+                    "subagent_id": str(tool.subagent_id) if tool.subagent_id else None,
+                    "config": tool.config,
+                    "is_active": tool.is_active,
+                    "order": tool.order,
+                }
+                for tool in agent.tools.all().order_by('order', 'name')
+            ],
+
+            # Dynamic tools (from function discovery)
+            "dynamic_tools": [
+                {
+                    "id": str(dt.id),
+                    "name": dt.name,
+                    "description": dt.description,
+                    "function_path": dt.function_path,
+                    "source_file": dt.source_file,
+                    "source_line": dt.source_line,
+                    "parameters_schema": dt.parameters_schema,
+                    "execution_mode": dt.execution_mode,
+                    "timeout_seconds": dt.timeout_seconds,
+                    "is_safe": dt.is_safe,
+                    "requires_confirmation": dt.requires_confirmation,
+                    "allowed_for_auto_execution": dt.allowed_for_auto_execution,
+                    "allowed_imports": dt.allowed_imports,
+                    "blocked_imports": dt.blocked_imports,
+                    "is_active": dt.is_active,
+                    "is_verified": dt.is_verified,
+                    "version": dt.version,
+                }
+                for dt in agent.dynamic_tools.all().order_by('name')
+            ],
+
+            # Knowledge sources
+            "knowledge": [
+                {
+                    "id": str(k.id),
+                    "name": k.name,
+                    "knowledge_type": k.knowledge_type,
+                    "content": k.content if k.knowledge_type == 'text' else None,
+                    "url": k.url if k.knowledge_type == 'url' else None,
+                    "file": k.file.url if k.file else None,
+                    "dynamic_config": k.dynamic_config if k.knowledge_type == 'dynamic' else None,
+                    "inclusion_mode": k.inclusion_mode,
+                    "is_active": k.is_active,
+                    "order": k.order,
+                    # RAG-specific fields
+                    "embedding_status": k.embedding_status,
+                    "chunk_count": k.chunk_count,
+                    "indexed_at": k.indexed_at.isoformat() if k.indexed_at else None,
+                    "rag_config": k.rag_config,
+                }
+                for k in agent.knowledge_sources.all().order_by('order', 'name')
+            ],
+
+            # Available discovered functions (not yet converted to tools)
+            "available_functions": [
+                {
+                    "id": str(f.id),
+                    "name": f.name,
+                    "module_path": f.module_path,
+                    "function_path": f.function_path,
+                    "function_type": f.function_type,
+                    "class_name": f.class_name,
+                    "file_path": f.file_path,
+                    "line_number": f.line_number,
+                    "signature": f.signature,
+                    "docstring": f.docstring,
+                    "parameters": f.parameters,
+                    "return_type": f.return_type,
+                    "is_async": f.is_async,
+                    "has_side_effects": f.has_side_effects,
+                    "is_private": f.is_private,
+                    "is_selected": f.is_selected,
+                }
+                for f in DiscoveredFunction.objects.filter(is_selected=False).order_by('module_path', 'name')[:100]
+            ],
+
+            # Effective config (merged with parent)
+            "effective_config": agent.get_effective_config(),
+
+            # Portable config format (for export)
+            "portable_config": agent.to_config_dict(),
+        }
+
+        return Response(schema)
+
+    def put(self, request, pk):
+        """Update the agent configuration from a full schema."""
+        agent = get_agent_for_user(request.user, pk)
+
+        data = request.data
+
+        # Update agent metadata
+        if 'name' in data:
+            agent.name = data['name']
+        if 'description' in data:
+            agent.description = data['description']
+        if 'icon' in data:
+            agent.icon = data['icon']
+        if 'is_public' in data:
+            agent.is_public = data['is_public']
+        if 'is_template' in data:
+            agent.is_template = data['is_template']
+        if 'is_active' in data:
+            agent.is_active = data['is_active']
+        if 'rag_config' in data:
+            agent.rag_config = data['rag_config']
+
+        agent.save()
+
+        # Update active version
+        if 'version' in data:
+            version_data = data['version']
+            active_version = agent.versions.filter(is_active=True).first()
+
+            if active_version:
+                if 'system_prompt' in version_data:
+                    active_version.system_prompt = version_data['system_prompt']
+                if 'model' in version_data:
+                    active_version.model = version_data['model']
+                if 'model_settings' in version_data:
+                    active_version.model_settings = version_data['model_settings']
+                if 'extra_config' in version_data:
+                    active_version.extra_config = version_data['extra_config']
+                if 'notes' in version_data:
+                    active_version.notes = version_data['notes']
+                active_version.save()
+
+        # Update tools
+        if 'tools' in data:
+            for tool_data in data['tools']:
+                if 'id' in tool_data:
+                    try:
+                        tool = agent.tools.get(id=tool_data['id'])
+                        for field in ['name', 'description', 'tool_type', 'parameters_schema',
+                                      'builtin_ref', 'config', 'is_active', 'order']:
+                            if field in tool_data:
+                                setattr(tool, field, tool_data[field])
+                        tool.save()
+                    except AgentTool.DoesNotExist:
+                        pass
+                else:
+                    # Create new tool
+                    AgentTool.objects.create(
+                        agent=agent,
+                        name=tool_data.get('name', 'new_tool'),
+                        tool_type=tool_data.get('tool_type', 'function'),
+                        description=tool_data.get('description', ''),
+                        parameters_schema=tool_data.get('parameters_schema', {}),
+                        builtin_ref=tool_data.get('builtin_ref', ''),
+                        config=tool_data.get('config', {}),
+                        is_active=tool_data.get('is_active', True),
+                        order=tool_data.get('order', 0),
+                    )
+
+        # Update dynamic tools
+        if 'dynamic_tools' in data:
+            for dt_data in data['dynamic_tools']:
+                if 'id' in dt_data:
+                    try:
+                        dt = agent.dynamic_tools.get(id=dt_data['id'])
+                        for field in ['name', 'description', 'function_path', 'parameters_schema',
+                                      'execution_mode', 'timeout_seconds', 'is_safe',
+                                      'requires_confirmation', 'allowed_for_auto_execution',
+                                      'allowed_imports', 'blocked_imports', 'is_active', 'is_verified']:
+                            if field in dt_data:
+                                setattr(dt, field, dt_data[field])
+                        dt.save()
+                    except DynamicTool.DoesNotExist:
+                        pass
+
+        # Update knowledge sources
+        if 'knowledge' in data:
+            for k_data in data['knowledge']:
+                if 'id' in k_data:
+                    try:
+                        k = agent.knowledge_sources.get(id=k_data['id'])
+                        for field in ['name', 'knowledge_type', 'content', 'url',
+                                      'dynamic_config', 'inclusion_mode', 'is_active',
+                                      'order', 'rag_config']:
+                            if field in k_data:
+                                setattr(k, field, k_data[field])
+                        k.save()
+                    except AgentKnowledge.DoesNotExist:
+                        pass
+
+        # Create a revision to track this change
+        from django_agent_runtime.models import AgentRevision
+        AgentRevision.create_from_agent(
+            agent,
+            comment=f"Updated via schema editor by {request.user.email}",
+            user=request.user,
+        )
+
+        return Response({
+            "status": "updated",
+            "message": "Agent schema updated successfully",
+        })
+
+
+# =============================================================================
+# Multi-Agent System Views
+# =============================================================================
+
+from django_agent_studio.api.serializers import (
+    AgentSystemListSerializer,
+    AgentSystemDetailSerializer,
+    AgentSystemCreateSerializer,
+    AgentSystemMemberSerializer,
+    AgentSystemVersionSerializer,
+    AddMemberSerializer,
+    PublishVersionSerializer,
+)
+
+
+class AgentSystemListCreateView(generics.ListCreateAPIView):
+    """List and create agent systems."""
+
+    permission_classes = [IsAuthenticated]
+
+    def get_serializer_class(self):
+        if self.request.method == 'POST':
+            return AgentSystemCreateSerializer
+        return AgentSystemListSerializer
+
+    def get_queryset(self):
+        return get_system_queryset_for_user(self.request.user)
+
+    def create(self, request, *args, **kwargs):
+        serializer = self.get_serializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+
+        # Get the entry agent
+        entry_agent = get_agent_for_user(request.user, serializer.validated_data['entry_agent_id'])
+
+        # Use the service to create the system
+        from django_agent_runtime.services.multi_agent import create_system_from_entry_agent
+
+        system = create_system_from_entry_agent(
+            slug=serializer.validated_data['slug'],
+            name=serializer.validated_data['name'],
+            entry_agent=entry_agent,
+            description=serializer.validated_data.get('description', ''),
+            owner=request.user,
+            auto_discover=serializer.validated_data.get('auto_discover', True),
+        )
+
+        return Response(
+            AgentSystemDetailSerializer(system).data,
+            status=status.HTTP_201_CREATED,
+        )
+
+
+class AgentSystemDetailView(generics.RetrieveUpdateDestroyAPIView):
+    """Retrieve, update, or delete an agent system."""
+
+    permission_classes = [IsAuthenticated]
+    serializer_class = AgentSystemDetailSerializer
+
+    def get_queryset(self):
+        return get_system_queryset_for_user(self.request.user)
+
+
+class AgentSystemMemberListCreateView(generics.ListCreateAPIView):
+    """List and add members to a system."""
+
+    permission_classes = [IsAuthenticated]
+
+    def get_serializer_class(self):
+        if self.request.method == 'POST':
+            return AddMemberSerializer
+        return AgentSystemMemberSerializer
+
+    def get_queryset(self):
+        system = get_system_for_user(self.request.user, self.kwargs['system_id'])
+        return system.members.select_related('agent').all()
+
+    def create(self, request, *args, **kwargs):
+        system = get_system_for_user(request.user, self.kwargs['system_id'])
+
+        serializer = self.get_serializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+
+        agent = get_agent_for_user(request.user, serializer.validated_data['agent_id'])
+
+        from django_agent_runtime.services.multi_agent import add_agent_to_system
+
+        member = add_agent_to_system(
+            system=system,
+            agent=agent,
+            role=serializer.validated_data.get('role', AgentSystemMember.Role.SPECIALIST),
+            notes=serializer.validated_data.get('notes', ''),
+        )
+
+        return Response(
+            AgentSystemMemberSerializer(member).data,
+            status=status.HTTP_201_CREATED,
+        )
+
+
+class AgentSystemMemberDetailView(generics.RetrieveUpdateDestroyAPIView):
+    """Retrieve, update, or delete a system member."""
+
+    permission_classes = [IsAuthenticated]
+    serializer_class = AgentSystemMemberSerializer
+
+    def get_queryset(self):
+        system = get_system_for_user(self.request.user, self.kwargs['system_id'])
+        return system.members.all()
+
+
+class AgentSystemVersionListView(generics.ListAPIView):
+    """List versions of a system."""
+
+    permission_classes = [IsAuthenticated]
+    serializer_class = AgentSystemVersionSerializer
+
+    def get_queryset(self):
+        system = get_system_for_user(self.request.user, self.kwargs['system_id'])
+        return system.versions.all()
+
+
+class AgentSystemPublishView(APIView):
+    """Publish a new version of a system."""
+
+    permission_classes = [IsAuthenticated]
+
+    def post(self, request, system_id):
+        system = get_system_for_user(request.user, system_id)
+
+        serializer = PublishVersionSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+
+        from django_agent_runtime.services.multi_agent import publish_system_version
+
+        version = publish_system_version(
+            system=system,
+            version=serializer.validated_data['version'],
+            notes=serializer.validated_data.get('notes', ''),
+            user=request.user,
+            make_active=serializer.validated_data.get('make_active', False),
+        )
+
+        return Response(
+            AgentSystemVersionSerializer(version).data,
+            status=status.HTTP_201_CREATED,
+        )
+
+
+class AgentSystemDeployView(APIView):
+    """Deploy (activate) a system version."""
+
+    permission_classes = [IsAuthenticated]
+
+    def post(self, request, system_id, version_id):
+        system = get_system_for_user(request.user, system_id)
+        version = get_object_or_404(system.versions, id=version_id)
+
+        from django_agent_runtime.services.multi_agent import deploy_system_version
+
+        deploy_system_version(version)
+
+        return Response(AgentSystemVersionSerializer(version).data)
+
+
+class AgentSystemExportView(APIView):
+    """Export a system version as portable JSON."""
+
+    permission_classes = [IsAuthenticated]
+
+    def get(self, request, system_id, version_id):
+        system = get_system_for_user(request.user, system_id)
+        version = get_object_or_404(system.versions, id=version_id)
+
+        embed_agents = request.query_params.get('embed', 'true').lower() == 'true'
+
+        from django_agent_runtime.services.multi_agent import export_system_version
+
+        config = export_system_version(version, embed_agents=embed_agents)
+
+        return Response(config)
+
+
+class AgentSystemDiscoverView(APIView):
+    """Discover all agents reachable from an entry agent."""
+
+    permission_classes = [IsAuthenticated]
+
+    def get(self, request, agent_id):
+        agent = get_agent_for_user(request.user, agent_id)
+
+        from django_agent_runtime.services.multi_agent import discover_system_agents
+
+        agents = discover_system_agents(agent)
+
+        return Response({
+            'entry_agent': {
+                'id': str(agent.id),
+                'slug': agent.slug,
+                'name': agent.name,
+            },
+            'discovered_agents': [
+                {
+                    'id': str(a.id),
+                    'slug': a.slug,
+                    'name': a.name,
+                    'description': a.description,
+                }
+                for a in agents
+            ],
+            'total_count': len(agents),
+        })