Merge remote-tracking branch github/main

This commit is contained in:
Chris Christiansen 2026-06-23 11:15:16 +00:00
commit 4610521e73
5 changed files with 279 additions and 145 deletions

View File

@ -13,6 +13,7 @@ import google.auth
import google.auth.transport.requests
from typing import Literal
import vertexai
from google.adk.agents import Agent
from google.adk.tools import FunctionTool
from google.adk.runners import Runner
@ -22,16 +23,24 @@ from google.genai import types
logger = logging.getLogger(__name__)
PROJECT_ID = os.environ.get("GOOGLE_CLOUD_PROJECT", "propane-will-491900-m5")
LOCATION = os.environ.get("GOOGLE_CLOUD_LOCATION", "global")
LOCATION = os.environ.get("GOOGLE_CLOUD_LOCATION", "us-central1")
# Initialiser Vertex AI eksplisitt — ADK krev dette for Cloud Run
vertexai.init(project=PROJECT_ID, location=LOCATION)
ORCHESTRATOR_MODEL = os.environ.get("ORCHESTRATOR_MODEL", "gemini-2.5-flash")
SUBAGENT_MODEL = os.environ.get("SUBAGENT_MODEL", "gemini-2.5-flash")
REASONING_MODEL = os.environ.get("REASONING_MODEL", "gemini-2.5-flash")
HEAVY_ORCHESTRATOR = os.environ.get("HEAVY_ORCHESTRATOR_MODEL", "gemini-2.5-pro")
HEAVY_SUBAGENT = os.environ.get("HEAVY_SUBAGENT_MODEL", "gemini-2.5-pro")
HEAVY_REASONING = os.environ.get("HEAVY_REASONING_MODEL", "gemini-2.5-flash")
BUDGET_LIGHT = float(os.environ.get("BUDGET_A_USD_PER_TASK", "1.0"))
BUDGET_HEAVY = float(os.environ.get("HEAVY_MODE_BUDGET_USD_PER_DAY", "3.0"))
HEAVY_MODE_ALLOWED_USERS = ["opax", "admin"]
Mode = Literal["light", "heavy"]
APP_NAME = "opax"
@ -43,23 +52,34 @@ except ImportError:
try:
import sys as _sys, pathlib as _pathlib
_sys.path.insert(0, str(_pathlib.Path(__file__).parent.parent.parent / "ml"))
from token_budget import trim_context, route_model, TokenBudgetExceeded, budget_summary
logger.info(f"[agent] token_budget lastet: {budget_summary()}")
except ImportError as _e:
logger.warning(f"[agent] token_budget ikke tilgjengelig: {_e}")
def trim_context(history, system_prompt="", max_tokens=32000):
return history[-10:] if len(history) > 10 else history
def route_model(message, mode, flash_model, pro_model):
return flash_model if mode != "heavy" else pro_model
class TokenBudgetExceeded(Exception): pass
_OPAX_MCP_URL = os.environ.get("MCP_SERVER_URL", "https://opax-mcp-zjbqp3prqq-uc.a.run.app")
create_bq_table_if_not_exists()
# ---------------------------------------------------------------------------
# OPAX MCP Client (inlina)
# ---------------------------------------------------------------------------
_OPAX_MCP_URL = os.environ.get("MCP_SERVER_URL", "https://opax-mcp-357036551735.us-central1.run.app")
_MCP_SECRET = os.environ.get("MCP_SECRET", "")
def _identity_token() -> str:
metadata_url = (
"http://metadata.google.internal/computeMetadata/v1/instance"
f"/service-accounts/default/identity?audience={_OPAX_MCP_URL}&format=full"
)
try:
resp = httpx.get(
f"http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience={_OPAX_MCP_URL}&format=full",
headers={"Metadata-Flavor": "Google"}, timeout=5)
resp = httpx.get(metadata_url, headers={"Metadata-Flavor": "Google"}, timeout=5)
if resp.status_code == 200 and resp.text.strip():
return resp.text.strip()
except Exception:
@ -68,134 +88,199 @@ def _identity_token() -> str:
credentials.refresh(google.auth.transport.requests.Request())
return credentials.token
def _mcp_headers() -> dict:
return {"Authorization": f"Bearer {_identity_token()}", "X-MCP-Secret": _MCP_SECRET, "Content-Type": "application/json"}
return {
"Authorization": f"Bearer {_identity_token()}",
"X-MCP-Secret": _MCP_SECRET,
"Content-Type": "application/json",
}
def _call_tool(tool: str, params: dict = None) -> dict:
resp = httpx.post(f"{_OPAX_MCP_URL}/tools/call", headers=_mcp_headers(), json={"tool": tool, "params": params or {}}, timeout=30)
resp = httpx.post(
f"{_OPAX_MCP_URL}/tools/call",
headers=_mcp_headers(),
json={"tool": tool, "params": params or {}},
timeout=30,
)
resp.raise_for_status()
return resp.json()
def get_billing_summary() -> dict:
"""Hent billing-oversikt for OSVauco (GCP-kostnader, token-forbruk)."""
return _call_tool("get_billing_summary")
def get_billing_credits() -> dict:
"""Hent gjenværende GCP-kreditter og burn-rate."""
return _call_tool("get_billing_credits")
def get_billing_anomalies() -> dict:
"""Sjekk for kostnadanomalier og uventede spiker."""
return _call_tool("get_billing_anomalies")
def get_billing_history() -> dict:
"""Hent historisk kostnadsdata (90 dagar)."""
return _call_tool("get_billing_history")
def get_billing_budget() -> dict:
"""Hent gjeldande budsjett for OSVauco."""
return _call_tool("get_billing_budget")
def set_billing_budget(amount: float) -> dict:
"""Sett nytt budsjettgrense. amount er beløpet i USD."""
return _call_tool("set_billing_budget", {"amount": amount})
def create_invite(email: str, company: str = "", tier: str = "starter") -> dict:
"""Opprett invite-link for ny kunde. tier: starter | guard | shield | enterprise."""
return _call_tool("create_invite", {"email": email, "company": company, "tier": tier})
def list_customers() -> dict:
"""List alle onboardede kunder og systemtilstand."""
return _call_tool("list_customers")
def send_webhook(message: str, url: str = "", title: str = "OPAX varsel") -> dict:
"""Send webhook-varsling til Slack/Teams/Discord."""
return _call_tool("send_webhook", {"message": message, "url": url, "title": title})
def send_email(to: str, subject: str, body: str = "") -> dict:
"""Send e-post via SendGrid."""
return _call_tool("send_email", {"to": to, "subject": subject, "body": body})
def get_notify_channels() -> dict:
"""List konfigurerte varslingskanalar."""
return _call_tool("get_notify_channels")
def get_health() -> dict:
"""Sjekk helsestatus for OPAX-plattformen."""
return _call_tool("get_health")
def get_build_status() -> dict:
"""Hent status på siste Cloud Build-kjøring."""
return _call_tool("get_build_status")
def get_state() -> dict:
"""Hent gjeldande systemtilstand og agent-statistikk for OSVauco."""
return _call_tool("get_state")
def get_telemetry() -> dict:
"""Hent token-forbruk og ytingsdata per modul."""
return _call_tool("get_telemetry")
def run_terminal(command: str) -> dict:
"""Kjør whitelist-kommando i OPAX terminal. Gyldige: health, billing, build, logs, help."""
return _call_tool("run_terminal", {"command": command})
def list_commits(limit: int = 10) -> dict:
"""List siste commits i OSVauco-repoet på Gitea."""
return _call_tool("list_commits", {"limit": limit})
def get_file(path: str) -> dict:
"""Hent innhald i ein fil frå Gitea-repoet."""
return _call_tool("get_file", {"path": path})
def list_open_issues() -> dict:
"""List alle opne issues i OSVauco Gitea-repoet."""
return _call_tool("list_open_issues", {})
def create_issue(title: str, body: str = "") -> dict:
"""Opprett nytt issue i Gitea-repoet."""
return _call_tool("create_issue", {"title": title, "body": body})
def push_file(path: str, content: str, message: str = "", sha: str = "") -> dict:
"""Push/oppdater ein fil i Gitea."""
return _call_tool("push_file", {"path": path, "content": content, "message": message, "sha": sha})
OPAX_TOOLS = [
FunctionTool(func=get_billing_summary), FunctionTool(func=get_billing_credits),
FunctionTool(func=get_billing_anomalies), FunctionTool(func=get_billing_history),
FunctionTool(func=get_billing_budget), FunctionTool(func=set_billing_budget),
FunctionTool(func=create_invite), FunctionTool(func=list_customers),
FunctionTool(func=send_webhook), FunctionTool(func=send_email),
FunctionTool(func=get_notify_channels), FunctionTool(func=get_health),
FunctionTool(func=get_build_status), FunctionTool(func=get_state),
FunctionTool(func=get_telemetry), FunctionTool(func=run_terminal),
FunctionTool(func=list_commits), FunctionTool(func=get_file),
FunctionTool(func=list_open_issues), FunctionTool(func=create_issue),
FunctionTool(func=get_billing_summary),
FunctionTool(func=get_billing_credits),
FunctionTool(func=get_billing_anomalies),
FunctionTool(func=get_billing_history),
FunctionTool(func=get_billing_budget),
FunctionTool(func=set_billing_budget),
FunctionTool(func=create_invite),
FunctionTool(func=list_customers),
FunctionTool(func=send_webhook),
FunctionTool(func=send_email),
FunctionTool(func=get_notify_channels),
FunctionTool(func=get_health),
FunctionTool(func=get_build_status),
FunctionTool(func=get_state),
FunctionTool(func=get_telemetry),
FunctionTool(func=run_terminal),
FunctionTool(func=list_commits),
FunctionTool(func=get_file),
FunctionTool(func=list_open_issues),
FunctionTool(func=create_issue),
FunctionTool(func=push_file),
]
# ---------------------------------------------------------------------------
# Agent logic
# ---------------------------------------------------------------------------
def _normalize_mode(mode: str) -> str:
mapping = {"A": "light", "A+": "heavy", "light": "light", "heavy": "heavy"}
if mode not in mapping:
raise ValueError(f"Invalid mode '{mode}'. Must be 'light' or 'heavy'.")
return mapping[mode]
def authorize_mode(user_id: str, mode: str) -> None:
mode = _normalize_mode(mode)
if mode == "heavy" and user_id not in HEAVY_MODE_ALLOWED_USERS:
raise PermissionError(f"User '{user_id}' is not authorized for heavy mode.")
def get_models_for_mode(mode: Mode) -> dict:
if mode == "heavy":
return {"orchestrator": HEAVY_ORCHESTRATOR, "subagent": HEAVY_SUBAGENT, "reasoning": HEAVY_REASONING, "budget_usd": BUDGET_HEAVY}
return {"orchestrator": ORCHESTRATOR_MODEL, "subagent": SUBAGENT_MODEL, "reasoning": REASONING_MODEL, "budget_usd": BUDGET_LIGHT}
_INSTRUCTION_TEMPLATE = (
"Du er Jason Vauger — OPAX-agenten for Vauco AS. Modus: {mode}. Modell: {model}. "
"Du har tilgang til alle OPAX-tools via opax-mcp. "
"Tools: list_commits, get_file, push_file, create_issue, list_open_issues (Gitea), "
"get_billing_summary, get_billing_credits, get_billing_anomalies, "
"get_build_status, get_state, get_telemetry, run_terminal, "
"create_invite, list_customers, send_webhook, send_email, get_notify_channels. "
"Når brukaren ber om data — KALL ALLTID rett tool før du svarar. "
"Svar på norsk (bokmål) med mindre annet er bedt om. "
"HITL: ikkje kjør terraform/deploy utan godkjenning frå Chris."
)
def build_agent(mode: str = "light", message: str = "") -> tuple:
mode = _normalize_mode(mode)
models = get_models_for_mode(mode)
actual_model = route_model(message=message, mode=mode, flash_model=ORCHESTRATOR_MODEL, pro_model=models["orchestrator"])
instruction = _INSTRUCTION_TEMPLATE.format(mode=mode, model=actual_model)
agent = Agent(model=actual_model, name="jason_vauger", description=f"Jason Vauger — OPAX enterprise agent [{mode}]", instruction=instruction, tools=OPAX_TOOLS)
agent = Agent(
model=actual_model,
name="jason_vauger",
description=f"Jason Vauger — OPAX enterprise agent [{mode}]",
instruction=instruction,
tools=OPAX_TOOLS,
)
return agent, actual_model, instruction
root_agent, _, _ = build_agent(mode="light")
async def _run_async(message: str, user_id: str, session_id: str, mode: str, caller_type: str = "agent") -> str:
mode = _normalize_mode(mode)
agent, actual_model, instruction = build_agent(mode=mode, message=message)
module_name = f"jason/{mode}"
try:
trim_context([types.Content(role="user", parts=[types.Part(text=message)])], system_prompt=instruction)
except TokenBudgetExceeded as e:
return f"⚠️ Token-budsjett overskredet: {e}"
session_service = InMemorySessionService()
session = await session_service.create_session(app_name=APP_NAME, user_id=user_id, session_id=session_id)
runner = Runner(agent=agent, app_name=APP_NAME, session_service=session_service)
@ -204,6 +289,7 @@ async def _run_async(message: str, user_id: str, session_id: str, mode: str, cal
input_tokens = 0
output_tokens = 0
request_id = str(uuid.uuid4())
async for event in runner.run_async(user_id=user_id, session_id=session.id, new_message=new_message):
if event.is_final_response() and event.content and event.content.parts:
final_text = event.content.parts[0].text or ""
@ -211,15 +297,24 @@ async def _run_async(message: str, user_id: str, session_id: str, mode: str, cal
um = event.usage_metadata
input_tokens += getattr(um, "prompt_token_count", 0) or 0
output_tokens += getattr(um, "candidates_token_count", 0) or 0
if input_tokens > 0 or output_tokens > 0:
log_token_usage(agent_name=module_name, model_name=actual_model, input_tokens=input_tokens, output_tokens=output_tokens, request_id=request_id, module_name=module_name, caller_type=caller_type, session_id=session_id)
log_token_usage(
agent_name=module_name, model_name=actual_model,
input_tokens=input_tokens, output_tokens=output_tokens,
request_id=request_id, module_name=module_name,
caller_type=caller_type, session_id=session_id,
)
logger.info(f"[agent] {mode}/{actual_model} in={input_tokens} out={output_tokens} caller={caller_type} session={session_id}")
return final_text
def run(message: str, user_id: str = "opax", session_id: str = "default", mode: str = "light", caller_type: str = "agent") -> str:
mode = _normalize_mode(mode)
authorize_mode(user_id, mode)
return asyncio.run(_run_async(message=message, user_id=user_id, session_id=session_id, mode=mode, caller_type=caller_type))
if __name__ == "__main__":
import sys
logging.basicConfig(level=logging.WARNING)

View File

@ -1,39 +1,51 @@
#!/usr/bin/env python3
"""
deploy_agent.py Deploy ADK agent til Vertex AI Agent Engine
Usage: python3 deploy_agent.py [--project PROJECT_ID] [--region REGION] \
[--display-name DISPLAY_NAME] [--staging-bucket GS_URI]
Krever: google-cloud-aiplatform>=1.157.0, google-adk>=2.0.0
"""
import argparse
import sys
from pathlib import Path
import vertexai
from vertexai import agent_engines
from vertexai import agent_engines # riktig import for SDK >= 1.157.0
def deploy(project, region, display_name, staging_bucket):
def deploy(project: str, region: str, display_name: str, staging_bucket: str):
print(f"Initialiserer Vertex AI: project={project}, region={region}")
vertexai.init(project=project, location=region, staging_bucket=staging_bucket)
base_dir = Path(__file__).resolve().parent
sys.path.insert(0, str(base_dir))
# Importer Jason ADK agent
sys.path.insert(0, ".")
import agent as my_agent
import agent as _agent_module
root_agent = _agent_module.root_agent
print(f"Deployer agent '{display_name}'...")
remote = agent_engines.create(
root_agent,
print(f"Deployer agent '{display_name}' til Vertex AI Agent Engine i {region}...")
remote_agent = agent_engines.create(
my_agent.root_agent,
requirements=[
"google-cloud-aiplatform[adk,agent_engines]>=1.157.0",
"google-adk>=2.2.0",
"httpx>=0.27.0",
"google-auth>=2.29.0",
],
extra_packages=[str(base_dir / "agent.py")],
extra_packages=["./opax_mcp_client.py"],
display_name=display_name,
)
print(f"\n✅ Agent deployet!\n Resource name: {remote.resource_name}")
print(f"\n✅ Agent deployet!")
print(f" Resource name : {remote_agent.resource_name}")
print(f" Console : https://console.cloud.google.com/ai/agents?project={project}")
print(f" Region : {region}")
print("\n⚠️ Husk: kjør teardown når du er ferdig for å unngå unnødige kostnader.")
return remote_agent
if __name__ == "__main__":
parser = argparse.ArgumentParser()
parser = argparse.ArgumentParser(description="Deploy Jason ADK agent til Vertex AI")
parser.add_argument("--project", default="propane-will-491900-m5")
parser.add_argument("--region", default="us-central1")
parser.add_argument("--display-name", default="jason-vauger-v12")
parser.add_argument("--display-name", default="jason-vauger-v1")
parser.add_argument("--staging-bucket", default="gs://propane-will-491900-m5-agent-staging")
args = parser.parse_args()
deploy(args.project, args.region, args.display_name, args.staging_bucket)

View File

@ -1,6 +1,6 @@
"""
opax_mcp_client.py REST-klient for opax-mcp Cloud Run service.
Kopiert inn i core-logic/ slik at Vertex AI Agent Engine finn den ved deploy.
opax_mcp_client REST-klient for opax-mcp Cloud Run service.
Pakke-struktur for Vertex AI Agent Engine extra_packages-kompatibilitet.
Auth-lag:
1. Cloud Run IAM : Authorization: Bearer <identity-token> (automatisk)

View File

@ -1,29 +1,6 @@
# HANDOFF — 2026-06-19
## Status
Deploy SUCCESS kl 23:10 CEST — build 6af0bb06
## Problem løst
OPAX-hub (opax.vauco.no) hadde ikke-fungerende chat, panel-switching og suggest-knapper.
## Rot-årsak
Alle fetch()-kall manglet `credentials: 'include'` — IAP-cookies ble ikke sendt med API-requests.
## Fix
Lagt til `credentials: 'include'` i:
- fetchWithTimeout() — linje 804
- sendMessage() fetch til /run — linje 1102
- termKey() fetch til /terminal/exec — linje 1050
## Neste sesjon
- Verifiser at Jason-chat fungerer med IAP-auth i nettleser
- Sjekk at panel-switching og build-status oppdateres korrekt
---
# HANDOFF — Vauco OS
**Sist oppdatert:** 2026-06-15 19:46 CEST
**Sist oppdatert:** 2026-06-18 14:00 CEST
**Skrevet av:** Perplexity (Orchestrator)
**Status:** Fase B — Gitea er primær Git. GitHub er fasa ut.
@ -31,7 +8,7 @@ Lagt til `credentials: 'include'` i:
## ⚠️ KRITISKE REGLER — les alltid først
- **Hovudapp:** `main.py` i rot — IKKJE `agents/core-logic/app.py`
- **Hovedapp:** `main.py` i rot — IKKJE `agents/core-logic/app.py`
- **Dockerfile:** `agents/core-logic/Dockerfile` — WORKDIR `/app`, CMD uvicorn main:app
- **Region:** `us-central1` | **Service:** `osvauco-agent` | **Prosjekt:** `propane-will-491900-m5`
- **Test via proxy:** `gcloud run services proxy osvauco-agent --region us-central1 --project propane-will-491900-m5 --port 8181`
@ -44,7 +21,20 @@ Lagt til `credentials: 'include'` i:
---
## ✅ Fullført i dag (2026-06-15)
## ✅ Fullført i dag (2026-06-18) — IAP Auth fix for opax-mcp
| Oppgave | Status |
|---------|--------|
| Identifisert rotårsak: feil IAP audience i identity token-kall | ✅ |
| Lagt til `roles/iap.httpsResourceAccessor` for `jason-vauger` SA | ✅ |
| Oppdatert `opax-mcp/server.py` — ny env var `OPAX_IAP_CLIENT_ID` som audience | ✅ |
| Lagt til `OPAX_IAP_CLIENT_ID` env var i Cloud Run (revisjon 00019 — feil navn `IAP_CLIENT_ID`) | ⚠️ |
| Rettet env var navn til `OPAX_IAP_CLIENT_ID` i Cloud Run — revisjon 00020 deployed | ✅ |
| Revisjon `opax-mcp-00020-w6j` aktiv med 100% trafikk | ✅ |
---
## ✅ Fullført tidligere (2026-06-15)
| Oppgave | Status |
|---------|--------|
@ -53,7 +43,7 @@ Lagt til `credentials: 'include'` i:
| Jason deployet til Vertex AI Agent Engine | ✅ |
| Jason svarer på norsk og kallar tools automatisk | ✅ |
| Gitea installert på VM (`34.59.131.162:3000`) | ✅ |
| Gitea køyrer som systemd-teneste (overlever reboot) | ✅ |
| Gitea kjøyrer som systemd-teneste (overlever reboot) | ✅ |
| Mirror-repo sletta og erstatta med vanleg repo | ✅ |
| **2867 commits pusha frå GitHub → Gitea** | ✅ |
| Gitea API-tokens i Secret Manager | ✅ |
@ -61,92 +51,116 @@ Lagt til `credentials: 'include'` i:
---
## 🏗 Systemstatus
## 🖥 Systemstatus
| Komponent | URL / Referanse | Status |
|-----------|-----------------|--------|
| `osvauco-agent` Cloud Run | `us-central1` | ✅ Live |
| `opax-mcp` Cloud Run | `https://opax-mcp-zjbqp3prqq-uc.a.run.app` | ✅ Live (25 tools) |
| Jason Vertex AI Agent Engine | `reasoningEngines/237959055262351360` | ✅ Live |
| **Gitea (primær Git)** | `http://34.59.131.162:3000/chris/OSVauco` | ✅ Live + systemd |
| GitHub OSVauco | `https://github.com/vauco-saas/OSVauco` | ❌ Fasa ut |
| `opax.vauco.no` | — | ✅ Live |
| Emma (Gemma, lokal VM) | — | ⏳ Neste fase |
| osvauco-agent (Cloud Run) | https://osvauco-agent-zjbgp3prqg-uc.a.run.app | ✅ Live |
| opax-mcp (Cloud Run) | https://opax-mcp-357036551735.us-central1.run.app | ✅ Live (rev 00020) |
| opax frontend (IAP LB) | https://opax.vauco.no | ✅ Live |
| Jason (Vertex AI Agent) | Agent Engine, us-central1 | ✅ Live |
| Gitea (self-hosted) | http://34.59.131.162:3000 | ✅ Live |
| GitHub (legacy) | https://github.com/vauco-saas/OSVauco | ⚠️ Fasa ut |
---
## 🔑 Credentials
| System | Brukar | Verdi |
|--------|--------|-------|
| Gitea | `chris` | `OSVauco@Gitea2026!` |
| Gitea API token (jason-token2) | — | Secret Manager: `gitea-api-token` (`278c0b41...`) |
| Gitea API token (admin-token2) | — | `94527a0f5353c4b1db29a007b98f340b5fd1f385` |
| opax-mcp MCP_SECRET | — | Secret Manager: `mcp-server-key` |
| Jason Agent Engine | — | `reasoningEngines/237959055262351360` |
- **Gitea login:** `chris` / se Secret Manager
- **Gitea API-token:** Secret Manager → `gitea-api-token`
- **MCP-Secret:** Secret Manager → `mcp-secret`
- **Prosjekt:** `propane-will-491900-m5`
- **IAP OAuth Client ID (opax backend):** `357036551735-kq8nt71d38hfqlcfb3n52ef7ala4meo.apps.googleusercontent.com`
- **IAP Backend Service path:** `/projects/357036551735/global/backendServices/<navn>` (satt som `OPAX_IAP_CLIENT_ID` i Cloud Run)
---
## 🟠 Gjenstår (prioritert)
## 🎯 Gjenstår (prioritert)
| # | Oppgave | Notat |
|---|---------|-------|
| 1 | Oppdater `opax_mcp_client.py` GitHub-tools → Gitea API | Byt `api.github.com``34.59.131.162:3000/api/v1` |
| 2 | Cloud Build webhook → Gitea (ikkje GitHub) | Trigger på Gitea push |
| 3 | DNS `git.vauco.no``34.59.131.162` | Domene for Gitea |
| 4 | HTTPS/TLS for Gitea (Caddy) | Etter DNS |
| 5 | Emma — Gemma lokal på ML-3a GPU VM | Eiga fase |
| 6 | Sett manglande env-vars på `osvauco-agent` | `SENDGRID_API_KEY`, `TWILIO_*`, `NOTIFY_*` |
1. **KRITISK — Verifiser IAP auth end-to-end** — kjør verifikasjonskommando under og bekreft `HTTP/2 200`
2. Oppdater Gitea-klient-logikk i agenter (fra GitHub API → Gitea API)
3. DNS/TLS for Gitea (`git.vauco.no`)
4. GPU VM-arbeid (planlagt)
5. Smoke-test pipeline for opax-mcp etter IAP-fix
---
## 📌 Neste sesjon — start her
## 🚀 Neste sesjon — start her
### 1. Verifiser IAP auth fix (VIKTIGST)
Kjør fra `osvauco-dev-vm`:
```bash
# 1. Verifiser Gitea
curl -s http://34.59.131.162:3000/api/v1/repos/chris/OSVauco
-H "Authorization: token 94527a0f5353c4b1db29a007b98f340b5fd1f385"
| python3 -c "import sys,json; r=json.load(sys.stdin); print('mirror:', r['mirror'], '| commits OK')"
# Hent identity token med korrekt IAP audience
TOKEN=$(curl -s -H "Metadata-Flavor: Google" \
"http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=357036551735-kq8nt71d38hfqlcfb3n52ef7ala4meo.apps.googleusercontent.com&format=full")
# 2. Verifiser Jason
cd ~/OSVauco/agents/core-logic && source .venv/bin/activate
python3 - <<'EOF'
import vertexai
from vertexai import agent_engines
vertexai.init(project="propane-will-491900-m5", location="us-central1")
agent = agent_engines.get("projects/357036551735/locations/us-central1/reasoningEngines/237959055262351360")
session = agent.create_session(user_id="chris")
for event in agent.stream_query(user_id="chris", session_id=session["id"], message="Status?"):
if event.get("content"):
print(event["content"]["parts"][0].get("text", ""), end="")
EOF
# 3. Neste: oppdater opax_mcp_client.py til Gitea API
# Test mot opax via IAP load balancer
curl -si https://opax.vauco.no/opax/build-status \
-H "Authorization: Bearer $TOKEN" | head -5
```
Forventet: `HTTP/2 200` (tidligere: `HTTP/2 401`)
### 2. Sjekk Jason sin status
```bash
curl -s https://osvauco-agent-zjbgp3prqg-uc.a.run.app/health \
-H "Authorization: Bearer $(gcloud auth print-identity-token)"
```
### 3. Hva som ble fikset i opax-mcp/server.py
**Fil:** `opax-mcp/server.py` — commit `9542106` ("OPAX_IAP_CLIENT_ID som IAP audience i identitytoken")
**Endring linje 17:**
```python
# FØR:
OPAX_BASE_URL = os.environ.get("OPAX_BASE_URL", "https://opax.vauco.no")
# ETTER:
OPAX_BASE_URL = os.environ.get("OPAX_BASE_URL", "https://opax.vauco.no")
OPAX_IAP_CLIENT_ID = os.environ.get("OPAX_IAP_CLIENT_ID", "")
```
**Endring linje 37 (`_opax_identity_token`):**
```python
# FØR:
f"...identity?audience={OPAX_BASE_URL}&format=full"
# ETTER:
f"...identity?audience={OPAX_IAP_CLIENT_ID or OPAX_BASE_URL}&format=full"
```
**Cloud Run env vars på opax-mcp (aktive i rev 00020):**
| Navn | Verdi |
|------|-------|
| `OPAX_BASE_URL` | `https://opax.vauco.no` |
| `OPAX_IAP_CLIENT_ID` | `/projects/357036551735/global/backendServices/...` |
| `MCP_SECRET` | (fra Secret Manager) |
| `GOOGLE_CLOUD_PROJECT` | `propane-will-491900-m5` |
---
## 🗺 Arkitektur
## 🏗 Arkitektur
```
Chris (naturleg språk)
Jason Vauger (Vertex AI Agent Engine — Gemini 2.5 Flash)
reasoningEngines/237959055262351360
opax-mcp (Cloud Run — 25 tools)
https://opax-mcp-zjbqp3prqq-uc.a.run.app
┌─────────────────────────────────┐
│ Gitea 34.59.131.162:3000 │ ← Eigen Git (PRIMÆR)
│ GCP Cloud Build / Run │ ← CI/CD + hosting
│ GitHub — FASA UT │ ← Ikkje i bruk lenger
└─────────────────────────────────┘
Bruker
└─► Jason (Vertex AI Agent Engine, Gemini 2.5 Pro)
└─► osvauco-agent (Cloud Run)
└─► opax-mcp (Cloud Run)
└─► [IAP] opax.vauco.no
└─► OPAX backend (GCP)
```
---
*Jason Vauger — han blir den du trenger han til å bli.*
## NESTE OPPGAVE
Verifiser full agent-loop: Jason mottar spørsmål → kaller opax-mcp → får svar fra opax.vauco.no uten feil.
**Auth-flyt for opax-mcp → opax.vauco.no:**
```
opax-mcp container
→ GCE Metadata Service
→ identity token med audience = IAP_CLIENT_ID
→ Authorization: Bearer <token>
→ IAP validerer token
→ Request videresendt til OPAX backend
```

View File

@ -5,6 +5,8 @@ Auth: Cloud Run IAM (Authorization header) + X-MCP-Secret header for tool-level
import os
import httpx
import base64
import google.auth
import google.auth.transport.requests
from fastapi import FastAPI, HTTPException, Header
from pydantic import BaseModel
from typing import Optional, Any
@ -12,16 +14,7 @@ from typing import Optional, Any
app = FastAPI(title="opax-mcp", version="2.0.0")
OPAX_BASE_URL = os.environ.get("OPAX_BASE_URL", "https://opax.vauco.no")
IAP_CLIENT_ID = os.environ.get("IAP_CLIENT_ID", "357036551735-kq8nt7ld38hfqlcfb3n52ef7tala4meo.apps.googleusercontent.com")
async def _iap_token() -> str:
"""Fetch IAP identity token from GCP metadata server."""
url = (f"http://metadata.google.internal/computeMetadata/v1/instance/"
f"service-accounts/default/identity?audience={IAP_CLIENT_ID}&format=full")
async with httpx.AsyncClient(timeout=10) as c:
r = await c.get(url, headers={"Metadata-Flavor": "Google"})
r.raise_for_status()
return r.text.strip()
OPAX_IAP_CLIENT_ID = os.environ.get("OPAX_IAP_CLIENT_ID", "")
MCP_SECRET = os.environ.get("MCP_SECRET", "")
# Gitea
@ -37,6 +30,30 @@ def _auth_check(x_mcp_secret: Optional[str]):
raise HTTPException(status_code=401, detail="Unauthorized")
def _opax_identity_token() -> str:
"""Hent identity token for opax.vauco.no (Cloud Run IAP/IAM)."""
metadata_url = (
"http://metadata.google.internal/computeMetadata/v1/instance"
f"/service-accounts/default/identity?audience={OPAX_IAP_CLIENT_ID or OPAX_BASE_URL}&format=full"
)
try:
resp = httpx.get(metadata_url, headers={"Metadata-Flavor": "Google"}, timeout=5)
if resp.status_code == 200 and resp.text.strip():
return resp.text.strip()
except Exception:
pass
credentials, _ = google.auth.default()
credentials.refresh(google.auth.transport.requests.Request())
return credentials.token
def _opax_headers() -> dict:
return {
"Authorization": f"Bearer {_opax_identity_token()}",
"Content-Type": "application/json",
}
# ---------------------------------------------------------------------------
# Health
# ---------------------------------------------------------------------------
@ -79,19 +96,15 @@ async def list_tools(x_mcp_secret: Optional[str] = Header(default=None)):
# ---------------------------------------------------------------------------
async def _opax_get(path: str) -> Any:
token = await _iap_token()
async with httpx.AsyncClient(timeout=30) as client:
r = await client.get(f"{OPAX_BASE_URL}{path}",
headers={"Authorization": f"Bearer {token}"})
r = await client.get(f"{OPAX_BASE_URL}{path}", headers=_opax_headers())
r.raise_for_status()
return r.json()
async def _opax_post(path: str, body: dict) -> Any:
token = await _iap_token()
async with httpx.AsyncClient(timeout=30) as client:
r = await client.post(f"{OPAX_BASE_URL}{path}", json=body,
headers={"Authorization": f"Bearer {token}"})
r = await client.post(f"{OPAX_BASE_URL}{path}", json=body, headers=_opax_headers())
r.raise_for_status()
return r.json()
@ -217,7 +230,7 @@ async def run_emma(p):
# Platform tools
# ---------------------------------------------------------------------------
async def get_health(p): return await _opax_get("/health")
async def get_health(p): return await _opax_get("/health")
async def get_build_status(p): return await _opax_get("/opax/build-status")
async def get_state(p): return await _opax_get("/state")
async def get_telemetry(p): return await _opax_get("/telemetry/history")