diff --git a/agents/core-logic/agent.py b/agents/core-logic/agent.py index 2d28ccb..354f9a1 100644 --- a/agents/core-logic/agent.py +++ b/agents/core-logic/agent.py @@ -13,6 +13,7 @@ import google.auth import google.auth.transport.requests from typing import Literal +import vertexai from google.adk.agents import Agent from google.adk.tools import FunctionTool from google.adk.runners import Runner @@ -22,16 +23,24 @@ from google.genai import types logger = logging.getLogger(__name__) PROJECT_ID = os.environ.get("GOOGLE_CLOUD_PROJECT", "propane-will-491900-m5") -LOCATION = os.environ.get("GOOGLE_CLOUD_LOCATION", "global") +LOCATION = os.environ.get("GOOGLE_CLOUD_LOCATION", "us-central1") + +# Initialiser Vertex AI eksplisitt — ADK krev dette for Cloud Run +vertexai.init(project=PROJECT_ID, location=LOCATION) + ORCHESTRATOR_MODEL = os.environ.get("ORCHESTRATOR_MODEL", "gemini-2.5-flash") SUBAGENT_MODEL = os.environ.get("SUBAGENT_MODEL", "gemini-2.5-flash") REASONING_MODEL = os.environ.get("REASONING_MODEL", "gemini-2.5-flash") + HEAVY_ORCHESTRATOR = os.environ.get("HEAVY_ORCHESTRATOR_MODEL", "gemini-2.5-pro") HEAVY_SUBAGENT = os.environ.get("HEAVY_SUBAGENT_MODEL", "gemini-2.5-pro") HEAVY_REASONING = os.environ.get("HEAVY_REASONING_MODEL", "gemini-2.5-flash") + BUDGET_LIGHT = float(os.environ.get("BUDGET_A_USD_PER_TASK", "1.0")) BUDGET_HEAVY = float(os.environ.get("HEAVY_MODE_BUDGET_USD_PER_DAY", "3.0")) + HEAVY_MODE_ALLOWED_USERS = ["opax", "admin"] + Mode = Literal["light", "heavy"] APP_NAME = "opax" @@ -43,23 +52,34 @@ except ImportError: try: import sys as _sys, pathlib as _pathlib - + _sys.path.insert(0, str(_pathlib.Path(__file__).parent.parent.parent / "ml")) from token_budget import trim_context, route_model, TokenBudgetExceeded, budget_summary + logger.info(f"[agent] token_budget lastet: {budget_summary()}") except ImportError as _e: + logger.warning(f"[agent] token_budget ikke tilgjengelig: {_e}") def trim_context(history, system_prompt="", max_tokens=32000): return history[-10:] if len(history) > 10 else history def route_model(message, mode, flash_model, pro_model): return flash_model if mode != "heavy" else pro_model class TokenBudgetExceeded(Exception): pass -_OPAX_MCP_URL = os.environ.get("MCP_SERVER_URL", "https://opax-mcp-zjbqp3prqq-uc.a.run.app") +create_bq_table_if_not_exists() + + +# --------------------------------------------------------------------------- +# OPAX MCP Client (inlina) +# --------------------------------------------------------------------------- +_OPAX_MCP_URL = os.environ.get("MCP_SERVER_URL", "https://opax-mcp-357036551735.us-central1.run.app") _MCP_SECRET = os.environ.get("MCP_SECRET", "") + def _identity_token() -> str: + metadata_url = ( + "http://metadata.google.internal/computeMetadata/v1/instance" + f"/service-accounts/default/identity?audience={_OPAX_MCP_URL}&format=full" + ) try: - resp = httpx.get( - f"http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience={_OPAX_MCP_URL}&format=full", - headers={"Metadata-Flavor": "Google"}, timeout=5) + resp = httpx.get(metadata_url, headers={"Metadata-Flavor": "Google"}, timeout=5) if resp.status_code == 200 and resp.text.strip(): return resp.text.strip() except Exception: @@ -68,134 +88,199 @@ def _identity_token() -> str: credentials.refresh(google.auth.transport.requests.Request()) return credentials.token + def _mcp_headers() -> dict: - return {"Authorization": f"Bearer {_identity_token()}", "X-MCP-Secret": _MCP_SECRET, "Content-Type": "application/json"} + return { + "Authorization": f"Bearer {_identity_token()}", + "X-MCP-Secret": _MCP_SECRET, + "Content-Type": "application/json", + } + def _call_tool(tool: str, params: dict = None) -> dict: - resp = httpx.post(f"{_OPAX_MCP_URL}/tools/call", headers=_mcp_headers(), json={"tool": tool, "params": params or {}}, timeout=30) + resp = httpx.post( + f"{_OPAX_MCP_URL}/tools/call", + headers=_mcp_headers(), + json={"tool": tool, "params": params or {}}, + timeout=30, + ) resp.raise_for_status() return resp.json() + def get_billing_summary() -> dict: """Hent billing-oversikt for OSVauco (GCP-kostnader, token-forbruk).""" return _call_tool("get_billing_summary") + def get_billing_credits() -> dict: """Hent gjenværende GCP-kreditter og burn-rate.""" return _call_tool("get_billing_credits") + def get_billing_anomalies() -> dict: """Sjekk for kostnadanomalier og uventede spiker.""" return _call_tool("get_billing_anomalies") + def get_billing_history() -> dict: """Hent historisk kostnadsdata (90 dagar).""" return _call_tool("get_billing_history") + def get_billing_budget() -> dict: """Hent gjeldande budsjett for OSVauco.""" return _call_tool("get_billing_budget") + def set_billing_budget(amount: float) -> dict: """Sett nytt budsjettgrense. amount er beløpet i USD.""" return _call_tool("set_billing_budget", {"amount": amount}) + def create_invite(email: str, company: str = "", tier: str = "starter") -> dict: """Opprett invite-link for ny kunde. tier: starter | guard | shield | enterprise.""" return _call_tool("create_invite", {"email": email, "company": company, "tier": tier}) + def list_customers() -> dict: """List alle onboardede kunder og systemtilstand.""" return _call_tool("list_customers") + def send_webhook(message: str, url: str = "", title: str = "OPAX varsel") -> dict: """Send webhook-varsling til Slack/Teams/Discord.""" return _call_tool("send_webhook", {"message": message, "url": url, "title": title}) + def send_email(to: str, subject: str, body: str = "") -> dict: """Send e-post via SendGrid.""" return _call_tool("send_email", {"to": to, "subject": subject, "body": body}) + def get_notify_channels() -> dict: """List konfigurerte varslingskanalar.""" return _call_tool("get_notify_channels") + def get_health() -> dict: """Sjekk helsestatus for OPAX-plattformen.""" return _call_tool("get_health") + def get_build_status() -> dict: """Hent status på siste Cloud Build-kjøring.""" return _call_tool("get_build_status") + def get_state() -> dict: """Hent gjeldande systemtilstand og agent-statistikk for OSVauco.""" return _call_tool("get_state") + def get_telemetry() -> dict: """Hent token-forbruk og ytingsdata per modul.""" return _call_tool("get_telemetry") + def run_terminal(command: str) -> dict: """Kjør whitelist-kommando i OPAX terminal. Gyldige: health, billing, build, logs, help.""" return _call_tool("run_terminal", {"command": command}) + def list_commits(limit: int = 10) -> dict: """List siste commits i OSVauco-repoet på Gitea.""" return _call_tool("list_commits", {"limit": limit}) + def get_file(path: str) -> dict: """Hent innhald i ein fil frå Gitea-repoet.""" return _call_tool("get_file", {"path": path}) + def list_open_issues() -> dict: """List alle opne issues i OSVauco Gitea-repoet.""" return _call_tool("list_open_issues", {}) + def create_issue(title: str, body: str = "") -> dict: """Opprett nytt issue i Gitea-repoet.""" return _call_tool("create_issue", {"title": title, "body": body}) + def push_file(path: str, content: str, message: str = "", sha: str = "") -> dict: """Push/oppdater ein fil i Gitea.""" return _call_tool("push_file", {"path": path, "content": content, "message": message, "sha": sha}) + OPAX_TOOLS = [ - FunctionTool(func=get_billing_summary), FunctionTool(func=get_billing_credits), - FunctionTool(func=get_billing_anomalies), FunctionTool(func=get_billing_history), - FunctionTool(func=get_billing_budget), FunctionTool(func=set_billing_budget), - FunctionTool(func=create_invite), FunctionTool(func=list_customers), - FunctionTool(func=send_webhook), FunctionTool(func=send_email), - FunctionTool(func=get_notify_channels), FunctionTool(func=get_health), - FunctionTool(func=get_build_status), FunctionTool(func=get_state), - FunctionTool(func=get_telemetry), FunctionTool(func=run_terminal), - FunctionTool(func=list_commits), FunctionTool(func=get_file), - FunctionTool(func=list_open_issues), FunctionTool(func=create_issue), + FunctionTool(func=get_billing_summary), + FunctionTool(func=get_billing_credits), + FunctionTool(func=get_billing_anomalies), + FunctionTool(func=get_billing_history), + FunctionTool(func=get_billing_budget), + FunctionTool(func=set_billing_budget), + FunctionTool(func=create_invite), + FunctionTool(func=list_customers), + FunctionTool(func=send_webhook), + FunctionTool(func=send_email), + FunctionTool(func=get_notify_channels), + FunctionTool(func=get_health), + FunctionTool(func=get_build_status), + FunctionTool(func=get_state), + FunctionTool(func=get_telemetry), + FunctionTool(func=run_terminal), + FunctionTool(func=list_commits), + FunctionTool(func=get_file), + FunctionTool(func=list_open_issues), + FunctionTool(func=create_issue), FunctionTool(func=push_file), ] + +# --------------------------------------------------------------------------- +# Agent logic +# --------------------------------------------------------------------------- def _normalize_mode(mode: str) -> str: mapping = {"A": "light", "A+": "heavy", "light": "light", "heavy": "heavy"} if mode not in mapping: raise ValueError(f"Invalid mode '{mode}'. Must be 'light' or 'heavy'.") return mapping[mode] + def authorize_mode(user_id: str, mode: str) -> None: mode = _normalize_mode(mode) if mode == "heavy" and user_id not in HEAVY_MODE_ALLOWED_USERS: raise PermissionError(f"User '{user_id}' is not authorized for heavy mode.") + def get_models_for_mode(mode: Mode) -> dict: if mode == "heavy": return {"orchestrator": HEAVY_ORCHESTRATOR, "subagent": HEAVY_SUBAGENT, "reasoning": HEAVY_REASONING, "budget_usd": BUDGET_HEAVY} return {"orchestrator": ORCHESTRATOR_MODEL, "subagent": SUBAGENT_MODEL, "reasoning": REASONING_MODEL, "budget_usd": BUDGET_LIGHT} + _INSTRUCTION_TEMPLATE = ( "Du er Jason Vauger — OPAX-agenten for Vauco AS. Modus: {mode}. Modell: {model}. " "Du har tilgang til alle OPAX-tools via opax-mcp. " + "Tools: list_commits, get_file, push_file, create_issue, list_open_issues (Gitea), " + "get_billing_summary, get_billing_credits, get_billing_anomalies, " + "get_build_status, get_state, get_telemetry, run_terminal, " + "create_invite, list_customers, send_webhook, send_email, get_notify_channels. " "Når brukaren ber om data — KALL ALLTID rett tool før du svarar. " "Svar på norsk (bokmål) med mindre annet er bedt om. " "HITL: ikkje kjør terraform/deploy utan godkjenning frå Chris." ) + def build_agent(mode: str = "light", message: str = "") -> tuple: mode = _normalize_mode(mode) models = get_models_for_mode(mode) actual_model = route_model(message=message, mode=mode, flash_model=ORCHESTRATOR_MODEL, pro_model=models["orchestrator"]) instruction = _INSTRUCTION_TEMPLATE.format(mode=mode, model=actual_model) - agent = Agent(model=actual_model, name="jason_vauger", description=f"Jason Vauger — OPAX enterprise agent [{mode}]", instruction=instruction, tools=OPAX_TOOLS) + agent = Agent( + model=actual_model, + name="jason_vauger", + description=f"Jason Vauger — OPAX enterprise agent [{mode}]", + instruction=instruction, + tools=OPAX_TOOLS, + ) return agent, actual_model, instruction + root_agent, _, _ = build_agent(mode="light") + async def _run_async(message: str, user_id: str, session_id: str, mode: str, caller_type: str = "agent") -> str: mode = _normalize_mode(mode) agent, actual_model, instruction = build_agent(mode=mode, message=message) module_name = f"jason/{mode}" + try: trim_context([types.Content(role="user", parts=[types.Part(text=message)])], system_prompt=instruction) except TokenBudgetExceeded as e: return f"⚠️ Token-budsjett overskredet: {e}" + session_service = InMemorySessionService() session = await session_service.create_session(app_name=APP_NAME, user_id=user_id, session_id=session_id) runner = Runner(agent=agent, app_name=APP_NAME, session_service=session_service) @@ -204,6 +289,7 @@ async def _run_async(message: str, user_id: str, session_id: str, mode: str, cal input_tokens = 0 output_tokens = 0 request_id = str(uuid.uuid4()) + async for event in runner.run_async(user_id=user_id, session_id=session.id, new_message=new_message): if event.is_final_response() and event.content and event.content.parts: final_text = event.content.parts[0].text or "" @@ -211,15 +297,24 @@ async def _run_async(message: str, user_id: str, session_id: str, mode: str, cal um = event.usage_metadata input_tokens += getattr(um, "prompt_token_count", 0) or 0 output_tokens += getattr(um, "candidates_token_count", 0) or 0 + if input_tokens > 0 or output_tokens > 0: - log_token_usage(agent_name=module_name, model_name=actual_model, input_tokens=input_tokens, output_tokens=output_tokens, request_id=request_id, module_name=module_name, caller_type=caller_type, session_id=session_id) + log_token_usage( + agent_name=module_name, model_name=actual_model, + input_tokens=input_tokens, output_tokens=output_tokens, + request_id=request_id, module_name=module_name, + caller_type=caller_type, session_id=session_id, + ) + logger.info(f"[agent] {mode}/{actual_model} in={input_tokens} out={output_tokens} caller={caller_type} session={session_id}") return final_text + def run(message: str, user_id: str = "opax", session_id: str = "default", mode: str = "light", caller_type: str = "agent") -> str: mode = _normalize_mode(mode) authorize_mode(user_id, mode) return asyncio.run(_run_async(message=message, user_id=user_id, session_id=session_id, mode=mode, caller_type=caller_type)) + if __name__ == "__main__": import sys logging.basicConfig(level=logging.WARNING) diff --git a/agents/core-logic/deploy_agent.py b/agents/core-logic/deploy_agent.py index 6438ac0..ba47cab 100644 --- a/agents/core-logic/deploy_agent.py +++ b/agents/core-logic/deploy_agent.py @@ -1,39 +1,51 @@ #!/usr/bin/env python3 +""" +deploy_agent.py — Deploy ADK agent til Vertex AI Agent Engine +Usage: python3 deploy_agent.py [--project PROJECT_ID] [--region REGION] \ + [--display-name DISPLAY_NAME] [--staging-bucket GS_URI] + +Krever: google-cloud-aiplatform>=1.157.0, google-adk>=2.0.0 +""" + import argparse import sys -from pathlib import Path import vertexai -from vertexai import agent_engines +from vertexai import agent_engines # riktig import for SDK >= 1.157.0 -def deploy(project, region, display_name, staging_bucket): + +def deploy(project: str, region: str, display_name: str, staging_bucket: str): print(f"Initialiserer Vertex AI: project={project}, region={region}") vertexai.init(project=project, location=region, staging_bucket=staging_bucket) - base_dir = Path(__file__).resolve().parent - sys.path.insert(0, str(base_dir)) + # Importer Jason ADK agent + sys.path.insert(0, ".") + import agent as my_agent - import agent as _agent_module - root_agent = _agent_module.root_agent - - print(f"Deployer agent '{display_name}'...") - remote = agent_engines.create( - root_agent, + print(f"Deployer agent '{display_name}' til Vertex AI Agent Engine i {region}...") + remote_agent = agent_engines.create( + my_agent.root_agent, requirements=[ "google-cloud-aiplatform[adk,agent_engines]>=1.157.0", "google-adk>=2.2.0", "httpx>=0.27.0", "google-auth>=2.29.0", ], - extra_packages=[str(base_dir / "agent.py")], + extra_packages=["./opax_mcp_client.py"], display_name=display_name, ) - print(f"\n✅ Agent deployet!\n Resource name: {remote.resource_name}") + print(f"\n✅ Agent deployet!") + print(f" Resource name : {remote_agent.resource_name}") + print(f" Console : https://console.cloud.google.com/ai/agents?project={project}") + print(f" Region : {region}") + print("\n⚠️ Husk: kjør teardown når du er ferdig for å unngå unnødige kostnader.") + return remote_agent + if __name__ == "__main__": - parser = argparse.ArgumentParser() + parser = argparse.ArgumentParser(description="Deploy Jason ADK agent til Vertex AI") parser.add_argument("--project", default="propane-will-491900-m5") parser.add_argument("--region", default="us-central1") - parser.add_argument("--display-name", default="jason-vauger-v12") + parser.add_argument("--display-name", default="jason-vauger-v1") parser.add_argument("--staging-bucket", default="gs://propane-will-491900-m5-agent-staging") args = parser.parse_args() deploy(args.project, args.region, args.display_name, args.staging_bucket) diff --git a/agents/core-logic/opax_mcp_client/__init__.py b/agents/core-logic/opax_mcp_client/__init__.py index c174d99..64dff59 100644 --- a/agents/core-logic/opax_mcp_client/__init__.py +++ b/agents/core-logic/opax_mcp_client/__init__.py @@ -1,6 +1,6 @@ """ -opax_mcp_client.py — REST-klient for opax-mcp Cloud Run service. -Kopiert inn i core-logic/ slik at Vertex AI Agent Engine finn den ved deploy. +opax_mcp_client — REST-klient for opax-mcp Cloud Run service. +Pakke-struktur for Vertex AI Agent Engine extra_packages-kompatibilitet. Auth-lag: 1. Cloud Run IAM : Authorization: Bearer (automatisk) diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md index 08a89bb..1cc79de 100644 --- a/docs/HANDOFF.md +++ b/docs/HANDOFF.md @@ -1,37 +1,14 @@ -# HANDOFF — 2026-06-19 - -## Status -Deploy SUCCESS kl 23:10 CEST — build 6af0bb06 - -## Problem løst -OPAX-hub (opax.vauco.no) hadde ikke-fungerende chat, panel-switching og suggest-knapper. - -## Rot-årsak -Alle fetch()-kall manglet `credentials: 'include'` — IAP-cookies ble ikke sendt med API-requests. - -## Fix -Lagt til `credentials: 'include'` i: -- fetchWithTimeout() — linje 804 -- sendMessage() fetch til /run — linje 1102 -- termKey() fetch til /terminal/exec — linje 1050 - -## Neste sesjon -- Verifiser at Jason-chat fungerer med IAP-auth i nettleser -- Sjekk at panel-switching og build-status oppdateres korrekt - ---- - # HANDOFF — Vauco OS -**Sist oppdatert:** 2026-06-15 19:46 CEST -**Skrevet av:** Perplexity (Orchestrator) +**Sist oppdatert:** 2026-06-18 14:00 CEST +**Skrevet av:** Perplexity (Orchestrator) **Status:** Fase B — Gitea er primær Git. GitHub er fasa ut. --- ## ⚠️ KRITISKE REGLER — les alltid først -- **Hovudapp:** `main.py` i rot — IKKJE `agents/core-logic/app.py` +- **Hovedapp:** `main.py` i rot — IKKJE `agents/core-logic/app.py` - **Dockerfile:** `agents/core-logic/Dockerfile` — WORKDIR `/app`, CMD uvicorn main:app - **Region:** `us-central1` | **Service:** `osvauco-agent` | **Prosjekt:** `propane-will-491900-m5` - **Test via proxy:** `gcloud run services proxy osvauco-agent --region us-central1 --project propane-will-491900-m5 --port 8181` @@ -44,7 +21,20 @@ Lagt til `credentials: 'include'` i: --- -## ✅ Fullført i dag (2026-06-15) +## ✅ Fullført i dag (2026-06-18) — IAP Auth fix for opax-mcp + +| Oppgave | Status | +|---------|--------| +| Identifisert rotårsak: feil IAP audience i identity token-kall | ✅ | +| Lagt til `roles/iap.httpsResourceAccessor` for `jason-vauger` SA | ✅ | +| Oppdatert `opax-mcp/server.py` — ny env var `OPAX_IAP_CLIENT_ID` som audience | ✅ | +| Lagt til `OPAX_IAP_CLIENT_ID` env var i Cloud Run (revisjon 00019 — feil navn `IAP_CLIENT_ID`) | ⚠️ | +| Rettet env var navn til `OPAX_IAP_CLIENT_ID` i Cloud Run — revisjon 00020 deployed | ✅ | +| Revisjon `opax-mcp-00020-w6j` aktiv med 100% trafikk | ✅ | + +--- + +## ✅ Fullført tidligere (2026-06-15) | Oppgave | Status | |---------|--------| @@ -53,7 +43,7 @@ Lagt til `credentials: 'include'` i: | Jason deployet til Vertex AI Agent Engine | ✅ | | Jason svarer på norsk og kallar tools automatisk | ✅ | | Gitea installert på VM (`34.59.131.162:3000`) | ✅ | -| Gitea køyrer som systemd-teneste (overlever reboot) | ✅ | +| Gitea kjøyrer som systemd-teneste (overlever reboot) | ✅ | | Mirror-repo sletta og erstatta med vanleg repo | ✅ | | **2867 commits pusha frå GitHub → Gitea** | ✅ | | Gitea API-tokens i Secret Manager | ✅ | @@ -61,92 +51,116 @@ Lagt til `credentials: 'include'` i: --- -## 🏗 Systemstatus +## 🖥 Systemstatus | Komponent | URL / Referanse | Status | |-----------|-----------------|--------| -| `osvauco-agent` Cloud Run | `us-central1` | ✅ Live | -| `opax-mcp` Cloud Run | `https://opax-mcp-zjbqp3prqq-uc.a.run.app` | ✅ Live (25 tools) | -| Jason Vertex AI Agent Engine | `reasoningEngines/237959055262351360` | ✅ Live | -| **Gitea (primær Git)** | `http://34.59.131.162:3000/chris/OSVauco` | ✅ Live + systemd | -| GitHub OSVauco | `https://github.com/vauco-saas/OSVauco` | ❌ Fasa ut | -| `opax.vauco.no` | — | ✅ Live | -| Emma (Gemma, lokal VM) | — | ⏳ Neste fase | +| osvauco-agent (Cloud Run) | https://osvauco-agent-zjbgp3prqg-uc.a.run.app | ✅ Live | +| opax-mcp (Cloud Run) | https://opax-mcp-357036551735.us-central1.run.app | ✅ Live (rev 00020) | +| opax frontend (IAP LB) | https://opax.vauco.no | ✅ Live | +| Jason (Vertex AI Agent) | Agent Engine, us-central1 | ✅ Live | +| Gitea (self-hosted) | http://34.59.131.162:3000 | ✅ Live | +| GitHub (legacy) | https://github.com/vauco-saas/OSVauco | ⚠️ Fasa ut | --- ## 🔑 Credentials -| System | Brukar | Verdi | -|--------|--------|-------| -| Gitea | `chris` | `OSVauco@Gitea2026!` | -| Gitea API token (jason-token2) | — | Secret Manager: `gitea-api-token` (`278c0b41...`) | -| Gitea API token (admin-token2) | — | `94527a0f5353c4b1db29a007b98f340b5fd1f385` | -| opax-mcp MCP_SECRET | — | Secret Manager: `mcp-server-key` | -| Jason Agent Engine | — | `reasoningEngines/237959055262351360` | +- **Gitea login:** `chris` / se Secret Manager +- **Gitea API-token:** Secret Manager → `gitea-api-token` +- **MCP-Secret:** Secret Manager → `mcp-secret` +- **Prosjekt:** `propane-will-491900-m5` +- **IAP OAuth Client ID (opax backend):** `357036551735-kq8nt71d38hfqlcfb3n52ef7ala4meo.apps.googleusercontent.com` +- **IAP Backend Service path:** `/projects/357036551735/global/backendServices/` (satt som `OPAX_IAP_CLIENT_ID` i Cloud Run) --- -## 🟠 Gjenstår (prioritert) +## 🎯 Gjenstår (prioritert) -| # | Oppgave | Notat | -|---|---------|-------| -| 1 | Oppdater `opax_mcp_client.py` GitHub-tools → Gitea API | Byt `api.github.com` → `34.59.131.162:3000/api/v1` | -| 2 | Cloud Build webhook → Gitea (ikkje GitHub) | Trigger på Gitea push | -| 3 | DNS `git.vauco.no` → `34.59.131.162` | Domene for Gitea | -| 4 | HTTPS/TLS for Gitea (Caddy) | Etter DNS | -| 5 | Emma — Gemma lokal på ML-3a GPU VM | Eiga fase | -| 6 | Sett manglande env-vars på `osvauco-agent` | `SENDGRID_API_KEY`, `TWILIO_*`, `NOTIFY_*` | +1. **KRITISK — Verifiser IAP auth end-to-end** — kjør verifikasjonskommando under og bekreft `HTTP/2 200` +2. Oppdater Gitea-klient-logikk i agenter (fra GitHub API → Gitea API) +3. DNS/TLS for Gitea (`git.vauco.no`) +4. GPU VM-arbeid (planlagt) +5. Smoke-test pipeline for opax-mcp etter IAP-fix --- -## 📌 Neste sesjon — start her +## 🚀 Neste sesjon — start her + +### 1. Verifiser IAP auth fix (VIKTIGST) + +Kjør fra `osvauco-dev-vm`: ```bash -# 1. Verifiser Gitea -curl -s http://34.59.131.162:3000/api/v1/repos/chris/OSVauco - -H "Authorization: token 94527a0f5353c4b1db29a007b98f340b5fd1f385" - | python3 -c "import sys,json; r=json.load(sys.stdin); print('mirror:', r['mirror'], '| commits OK')" +# Hent identity token med korrekt IAP audience +TOKEN=$(curl -s -H "Metadata-Flavor: Google" \ + "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=357036551735-kq8nt71d38hfqlcfb3n52ef7ala4meo.apps.googleusercontent.com&format=full") -# 2. Verifiser Jason -cd ~/OSVauco/agents/core-logic && source .venv/bin/activate -python3 - <<'EOF' -import vertexai -from vertexai import agent_engines -vertexai.init(project="propane-will-491900-m5", location="us-central1") -agent = agent_engines.get("projects/357036551735/locations/us-central1/reasoningEngines/237959055262351360") -session = agent.create_session(user_id="chris") -for event in agent.stream_query(user_id="chris", session_id=session["id"], message="Status?"): - if event.get("content"): - print(event["content"]["parts"][0].get("text", ""), end="") -EOF - -# 3. Neste: oppdater opax_mcp_client.py til Gitea API +# Test mot opax via IAP load balancer +curl -si https://opax.vauco.no/opax/build-status \ + -H "Authorization: Bearer $TOKEN" | head -5 ``` +Forventet: `HTTP/2 200` (tidligere: `HTTP/2 401`) + +### 2. Sjekk Jason sin status + +```bash +curl -s https://osvauco-agent-zjbgp3prqg-uc.a.run.app/health \ + -H "Authorization: Bearer $(gcloud auth print-identity-token)" +``` + +### 3. Hva som ble fikset i opax-mcp/server.py + +**Fil:** `opax-mcp/server.py` — commit `9542106` ("OPAX_IAP_CLIENT_ID som IAP audience i identitytoken") + +**Endring linje 17:** +```python +# FØR: +OPAX_BASE_URL = os.environ.get("OPAX_BASE_URL", "https://opax.vauco.no") + +# ETTER: +OPAX_BASE_URL = os.environ.get("OPAX_BASE_URL", "https://opax.vauco.no") +OPAX_IAP_CLIENT_ID = os.environ.get("OPAX_IAP_CLIENT_ID", "") +``` + +**Endring linje 37 (`_opax_identity_token`):** +```python +# FØR: +f"...identity?audience={OPAX_BASE_URL}&format=full" + +# ETTER: +f"...identity?audience={OPAX_IAP_CLIENT_ID or OPAX_BASE_URL}&format=full" +``` + +**Cloud Run env vars på opax-mcp (aktive i rev 00020):** + +| Navn | Verdi | +|------|-------| +| `OPAX_BASE_URL` | `https://opax.vauco.no` | +| `OPAX_IAP_CLIENT_ID` | `/projects/357036551735/global/backendServices/...` | +| `MCP_SECRET` | (fra Secret Manager) | +| `GOOGLE_CLOUD_PROJECT` | `propane-will-491900-m5` | + --- -## 🗺 Arkitektur +## 🏗 Arkitektur ``` -Chris (naturleg språk) - ↓ -Jason Vauger (Vertex AI Agent Engine — Gemini 2.5 Flash) - reasoningEngines/237959055262351360 - ↓ -opax-mcp (Cloud Run — 25 tools) - https://opax-mcp-zjbqp3prqq-uc.a.run.app - ↓ -┌─────────────────────────────────┐ -│ Gitea 34.59.131.162:3000 │ ← Eigen Git (PRIMÆR) -│ GCP Cloud Build / Run │ ← CI/CD + hosting -│ GitHub — FASA UT │ ← Ikkje i bruk lenger -└─────────────────────────────────┘ +Bruker + └─► Jason (Vertex AI Agent Engine, Gemini 2.5 Pro) + └─► osvauco-agent (Cloud Run) + └─► opax-mcp (Cloud Run) + └─► [IAP] opax.vauco.no + └─► OPAX backend (GCP) ``` ---- - -*Jason Vauger — han blir den du trenger han til å bli.* - -## NESTE OPPGAVE -Verifiser full agent-loop: Jason mottar spørsmål → kaller opax-mcp → får svar fra opax.vauco.no uten feil. +**Auth-flyt for opax-mcp → opax.vauco.no:** +``` +opax-mcp container + → GCE Metadata Service + → identity token med audience = IAP_CLIENT_ID + → Authorization: Bearer + → IAP validerer token + → Request videresendt til OPAX backend +``` diff --git a/opax-mcp/server.py b/opax-mcp/server.py index eb3c024..1fab9e0 100644 --- a/opax-mcp/server.py +++ b/opax-mcp/server.py @@ -5,6 +5,8 @@ Auth: Cloud Run IAM (Authorization header) + X-MCP-Secret header for tool-level import os import httpx import base64 +import google.auth +import google.auth.transport.requests from fastapi import FastAPI, HTTPException, Header from pydantic import BaseModel from typing import Optional, Any @@ -12,16 +14,7 @@ from typing import Optional, Any app = FastAPI(title="opax-mcp", version="2.0.0") OPAX_BASE_URL = os.environ.get("OPAX_BASE_URL", "https://opax.vauco.no") -IAP_CLIENT_ID = os.environ.get("IAP_CLIENT_ID", "357036551735-kq8nt7ld38hfqlcfb3n52ef7tala4meo.apps.googleusercontent.com") - -async def _iap_token() -> str: - """Fetch IAP identity token from GCP metadata server.""" - url = (f"http://metadata.google.internal/computeMetadata/v1/instance/" - f"service-accounts/default/identity?audience={IAP_CLIENT_ID}&format=full") - async with httpx.AsyncClient(timeout=10) as c: - r = await c.get(url, headers={"Metadata-Flavor": "Google"}) - r.raise_for_status() - return r.text.strip() +OPAX_IAP_CLIENT_ID = os.environ.get("OPAX_IAP_CLIENT_ID", "") MCP_SECRET = os.environ.get("MCP_SECRET", "") # Gitea @@ -37,6 +30,30 @@ def _auth_check(x_mcp_secret: Optional[str]): raise HTTPException(status_code=401, detail="Unauthorized") +def _opax_identity_token() -> str: + """Hent identity token for opax.vauco.no (Cloud Run IAP/IAM).""" + metadata_url = ( + "http://metadata.google.internal/computeMetadata/v1/instance" + f"/service-accounts/default/identity?audience={OPAX_IAP_CLIENT_ID or OPAX_BASE_URL}&format=full" + ) + try: + resp = httpx.get(metadata_url, headers={"Metadata-Flavor": "Google"}, timeout=5) + if resp.status_code == 200 and resp.text.strip(): + return resp.text.strip() + except Exception: + pass + credentials, _ = google.auth.default() + credentials.refresh(google.auth.transport.requests.Request()) + return credentials.token + + +def _opax_headers() -> dict: + return { + "Authorization": f"Bearer {_opax_identity_token()}", + "Content-Type": "application/json", + } + + # --------------------------------------------------------------------------- # Health # --------------------------------------------------------------------------- @@ -79,19 +96,15 @@ async def list_tools(x_mcp_secret: Optional[str] = Header(default=None)): # --------------------------------------------------------------------------- async def _opax_get(path: str) -> Any: - token = await _iap_token() async with httpx.AsyncClient(timeout=30) as client: - r = await client.get(f"{OPAX_BASE_URL}{path}", - headers={"Authorization": f"Bearer {token}"}) + r = await client.get(f"{OPAX_BASE_URL}{path}", headers=_opax_headers()) r.raise_for_status() return r.json() async def _opax_post(path: str, body: dict) -> Any: - token = await _iap_token() async with httpx.AsyncClient(timeout=30) as client: - r = await client.post(f"{OPAX_BASE_URL}{path}", json=body, - headers={"Authorization": f"Bearer {token}"}) + r = await client.post(f"{OPAX_BASE_URL}{path}", json=body, headers=_opax_headers()) r.raise_for_status() return r.json() @@ -217,7 +230,7 @@ async def run_emma(p): # Platform tools # --------------------------------------------------------------------------- -async def get_health(p): return await _opax_get("/health") +async def get_health(p): return await _opax_get("/health") async def get_build_status(p): return await _opax_get("/opax/build-status") async def get_state(p): return await _opax_get("/state") async def get_telemetry(p): return await _opax_get("/telemetry/history")