Fix direct generate_later jobs, dashboard CSRF, model picker, builder errors and missing provider gems - #475
Merged
Conversation
GenerationJob#perform rejected the direct_generation_type, direct_args and direct_options keywords DirectGeneration enqueues with, so every direct generate_later/embed_later raised ArgumentError in the worker. The job now rebuilds the DirectGeneration from them rather than calling the synthetic __direct_*__ action name. Fixes #346 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KfFzc97pARf86bj8LNR59B
The OpenRouter catalog was cut to its first 100 ids after sorting, so everything late in the alphabet (openai/*, qwen/*, ...) could not be chosen. The API now returns the whole catalog, and the builder and editor pick a model with a type-ahead input over a datalist instead of a fixed <select>, which also accepts a model id the catalog doesn't list. Fixes #427 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KfFzc97pARf86bj8LNR59B
A 422 from POST /api/agents left the builder on its form with nothing but a transient toast that could sit behind the page. The API now also returns field_errors (attribute => messages); the builder shows a summary above the step, puts each message under its field, and returns to the Basics step when a field there was rejected. Fixes #426 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KfFzc97pARf86bj8LNR59B
Api::BaseController skipped forgery protection although its endpoints authenticate with the host's session cookie, so a state-changing request was reachable cross-site. Only three of the ten components that write sent a token, so the opt-out couldn't simply be dropped. The fetch shim that already puts "/api/" calls on the engine's mount (now utils/apiFetch.mjs, installed at every mount, root included) also attaches the page's X-CSRF-Token to every mutating request, replacing the per-component headers. With every writer covered, BaseController keeps the protection ApplicationController turns on and answers a rejected request with JSON. The MCP facade, authenticated by bearer token, skips it explicitly; trace ingest was already exempt. Fixes #461 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KfFzc97pARf86bj8LNR59B
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KfFzc97pARf86bj8LNR59B
Provider client gems are optional dependencies of activeagent, so an agent could be given openrouter in a host without the openai gem and only fail on its first run, mid-generation. The Agent model now checks the provider's client loads when the provider is chosen and reports the loader's own "add this gem" message as a validation error, which the builder and editor show on the form. Fixes #416 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KfFzc97pARf86bj8LNR59B
# Conflicts: # CHANGELOG.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Five bug fixes from the issue backlog, one commit each.
Agent.prompt(...).generate_later/Agent.embed(...).embed_laterraisedArgumentError: unknown keywordswhen the job ran.GenerationJob#performnow accepts the direct-generation keywords and rebuilds theDirectGenerationinstead of calling the synthetic__direct_*__action. Regression tests perform the enqueued jobs.Api::BaseControllerskipped forgery protection while authenticating by the host's session cookie. The existing fetch shim (nowfrontend/utils/apiFetch.mjs, installed at every mount including/) attachesX-CSRF-Tokento every mutating/api/request, replacing the per-component headers that 7 of 10 writers lacked.BaseControllerkeeps the protection and rescues failures as JSON422 {code: "invalid_csrf_token"};MCPController(bearer token) explicitly skips it; trace ingest was already exempt.ids.sort.first(100). The whole catalog is returned, and the builder/editor model field is a type-ahead<input list>over a<datalist>(ModelPicker) that also accepts an unlisted id.POST/PATCH /api/agents422s addfield_errors; the builder shows a summary plus per-field messages and returns to the Basics step. The toast gets a z-index above the loading overlay.Agentvalidates, when the provider is chosen, that its client gem loads, surfacing the loader's "add this gem" message instead of failing on the first run.The dashboard bundle is rebuilt in its own commit.
Heads-up for #474
actionagent/test/host_integration_test.rb:102on #474 assertsApi::BaseController's filters excludeverify_authenticity_token. After this PR they include it by design; that assertion should move tomcp_controller_filters.Testing
test/features/parameterized_direct_test.rb(jobs performed),actionagent/test/api_forgery_protection_test.rb,actionagent/test/agent_provider_client_test.rb, additions tocredentials_test.rbandengine_api_test.rb,frontend/test/apiFetch.test.mjs.node --test61/61; rubocop clean on changed files.mainin this environment.Fixes #346, fixes #416, fixes #426, fixes #427, fixes #461
🤖 Generated with Claude Code
https://claude.ai/code/session_01KfFzc97pARf86bj8LNR59B
Generated by Claude Code