Merge remote-tracking branch github/main
This commit is contained in:
commit
4610521e73
|
|
@ -13,6 +13,7 @@ import google.auth
|
|||
import google.auth.transport.requests
|
||||
from typing import Literal
|
||||
|
||||
import vertexai
|
||||
from google.adk.agents import Agent
|
||||
from google.adk.tools import FunctionTool
|
||||
from google.adk.runners import Runner
|
||||
|
|
@ -22,16 +23,24 @@ from google.genai import types
|
|||
logger = logging.getLogger(__name__)
|
||||
|
||||
PROJECT_ID = os.environ.get("GOOGLE_CLOUD_PROJECT", "propane-will-491900-m5")
|
||||
LOCATION = os.environ.get("GOOGLE_CLOUD_LOCATION", "global")
|
||||
LOCATION = os.environ.get("GOOGLE_CLOUD_LOCATION", "us-central1")
|
||||
|
||||
# Initialiser Vertex AI eksplisitt — ADK krev dette for Cloud Run
|
||||
vertexai.init(project=PROJECT_ID, location=LOCATION)
|
||||
|
||||
ORCHESTRATOR_MODEL = os.environ.get("ORCHESTRATOR_MODEL", "gemini-2.5-flash")
|
||||
SUBAGENT_MODEL = os.environ.get("SUBAGENT_MODEL", "gemini-2.5-flash")
|
||||
REASONING_MODEL = os.environ.get("REASONING_MODEL", "gemini-2.5-flash")
|
||||
|
||||
HEAVY_ORCHESTRATOR = os.environ.get("HEAVY_ORCHESTRATOR_MODEL", "gemini-2.5-pro")
|
||||
HEAVY_SUBAGENT = os.environ.get("HEAVY_SUBAGENT_MODEL", "gemini-2.5-pro")
|
||||
HEAVY_REASONING = os.environ.get("HEAVY_REASONING_MODEL", "gemini-2.5-flash")
|
||||
|
||||
BUDGET_LIGHT = float(os.environ.get("BUDGET_A_USD_PER_TASK", "1.0"))
|
||||
BUDGET_HEAVY = float(os.environ.get("HEAVY_MODE_BUDGET_USD_PER_DAY", "3.0"))
|
||||
|
||||
HEAVY_MODE_ALLOWED_USERS = ["opax", "admin"]
|
||||
|
||||
Mode = Literal["light", "heavy"]
|
||||
APP_NAME = "opax"
|
||||
|
||||
|
|
@ -43,23 +52,34 @@ except ImportError:
|
|||
|
||||
try:
|
||||
import sys as _sys, pathlib as _pathlib
|
||||
|
||||
_sys.path.insert(0, str(_pathlib.Path(__file__).parent.parent.parent / "ml"))
|
||||
from token_budget import trim_context, route_model, TokenBudgetExceeded, budget_summary
|
||||
logger.info(f"[agent] token_budget lastet: {budget_summary()}")
|
||||
except ImportError as _e:
|
||||
logger.warning(f"[agent] token_budget ikke tilgjengelig: {_e}")
|
||||
def trim_context(history, system_prompt="", max_tokens=32000):
|
||||
return history[-10:] if len(history) > 10 else history
|
||||
def route_model(message, mode, flash_model, pro_model):
|
||||
return flash_model if mode != "heavy" else pro_model
|
||||
class TokenBudgetExceeded(Exception): pass
|
||||
|
||||
_OPAX_MCP_URL = os.environ.get("MCP_SERVER_URL", "https://opax-mcp-zjbqp3prqq-uc.a.run.app")
|
||||
create_bq_table_if_not_exists()
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# OPAX MCP Client (inlina)
|
||||
# ---------------------------------------------------------------------------
|
||||
_OPAX_MCP_URL = os.environ.get("MCP_SERVER_URL", "https://opax-mcp-357036551735.us-central1.run.app")
|
||||
_MCP_SECRET = os.environ.get("MCP_SECRET", "")
|
||||
|
||||
|
||||
def _identity_token() -> str:
|
||||
metadata_url = (
|
||||
"http://metadata.google.internal/computeMetadata/v1/instance"
|
||||
f"/service-accounts/default/identity?audience={_OPAX_MCP_URL}&format=full"
|
||||
)
|
||||
try:
|
||||
resp = httpx.get(
|
||||
f"http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience={_OPAX_MCP_URL}&format=full",
|
||||
headers={"Metadata-Flavor": "Google"}, timeout=5)
|
||||
resp = httpx.get(metadata_url, headers={"Metadata-Flavor": "Google"}, timeout=5)
|
||||
if resp.status_code == 200 and resp.text.strip():
|
||||
return resp.text.strip()
|
||||
except Exception:
|
||||
|
|
@ -68,134 +88,199 @@ def _identity_token() -> str:
|
|||
credentials.refresh(google.auth.transport.requests.Request())
|
||||
return credentials.token
|
||||
|
||||
|
||||
def _mcp_headers() -> dict:
|
||||
return {"Authorization": f"Bearer {_identity_token()}", "X-MCP-Secret": _MCP_SECRET, "Content-Type": "application/json"}
|
||||
return {
|
||||
"Authorization": f"Bearer {_identity_token()}",
|
||||
"X-MCP-Secret": _MCP_SECRET,
|
||||
"Content-Type": "application/json",
|
||||
}
|
||||
|
||||
|
||||
def _call_tool(tool: str, params: dict = None) -> dict:
|
||||
resp = httpx.post(f"{_OPAX_MCP_URL}/tools/call", headers=_mcp_headers(), json={"tool": tool, "params": params or {}}, timeout=30)
|
||||
resp = httpx.post(
|
||||
f"{_OPAX_MCP_URL}/tools/call",
|
||||
headers=_mcp_headers(),
|
||||
json={"tool": tool, "params": params or {}},
|
||||
timeout=30,
|
||||
)
|
||||
resp.raise_for_status()
|
||||
return resp.json()
|
||||
|
||||
|
||||
def get_billing_summary() -> dict:
|
||||
"""Hent billing-oversikt for OSVauco (GCP-kostnader, token-forbruk)."""
|
||||
return _call_tool("get_billing_summary")
|
||||
|
||||
def get_billing_credits() -> dict:
|
||||
"""Hent gjenværende GCP-kreditter og burn-rate."""
|
||||
return _call_tool("get_billing_credits")
|
||||
|
||||
def get_billing_anomalies() -> dict:
|
||||
"""Sjekk for kostnadanomalier og uventede spiker."""
|
||||
return _call_tool("get_billing_anomalies")
|
||||
|
||||
def get_billing_history() -> dict:
|
||||
"""Hent historisk kostnadsdata (90 dagar)."""
|
||||
return _call_tool("get_billing_history")
|
||||
|
||||
def get_billing_budget() -> dict:
|
||||
"""Hent gjeldande budsjett for OSVauco."""
|
||||
return _call_tool("get_billing_budget")
|
||||
|
||||
def set_billing_budget(amount: float) -> dict:
|
||||
"""Sett nytt budsjettgrense. amount er beløpet i USD."""
|
||||
return _call_tool("set_billing_budget", {"amount": amount})
|
||||
|
||||
def create_invite(email: str, company: str = "", tier: str = "starter") -> dict:
|
||||
"""Opprett invite-link for ny kunde. tier: starter | guard | shield | enterprise."""
|
||||
return _call_tool("create_invite", {"email": email, "company": company, "tier": tier})
|
||||
|
||||
def list_customers() -> dict:
|
||||
"""List alle onboardede kunder og systemtilstand."""
|
||||
return _call_tool("list_customers")
|
||||
|
||||
def send_webhook(message: str, url: str = "", title: str = "OPAX varsel") -> dict:
|
||||
"""Send webhook-varsling til Slack/Teams/Discord."""
|
||||
return _call_tool("send_webhook", {"message": message, "url": url, "title": title})
|
||||
|
||||
def send_email(to: str, subject: str, body: str = "") -> dict:
|
||||
"""Send e-post via SendGrid."""
|
||||
return _call_tool("send_email", {"to": to, "subject": subject, "body": body})
|
||||
|
||||
def get_notify_channels() -> dict:
|
||||
"""List konfigurerte varslingskanalar."""
|
||||
return _call_tool("get_notify_channels")
|
||||
|
||||
def get_health() -> dict:
|
||||
"""Sjekk helsestatus for OPAX-plattformen."""
|
||||
return _call_tool("get_health")
|
||||
|
||||
def get_build_status() -> dict:
|
||||
"""Hent status på siste Cloud Build-kjøring."""
|
||||
return _call_tool("get_build_status")
|
||||
|
||||
def get_state() -> dict:
|
||||
"""Hent gjeldande systemtilstand og agent-statistikk for OSVauco."""
|
||||
return _call_tool("get_state")
|
||||
|
||||
def get_telemetry() -> dict:
|
||||
"""Hent token-forbruk og ytingsdata per modul."""
|
||||
return _call_tool("get_telemetry")
|
||||
|
||||
def run_terminal(command: str) -> dict:
|
||||
"""Kjør whitelist-kommando i OPAX terminal. Gyldige: health, billing, build, logs, help."""
|
||||
return _call_tool("run_terminal", {"command": command})
|
||||
|
||||
def list_commits(limit: int = 10) -> dict:
|
||||
"""List siste commits i OSVauco-repoet på Gitea."""
|
||||
return _call_tool("list_commits", {"limit": limit})
|
||||
|
||||
def get_file(path: str) -> dict:
|
||||
"""Hent innhald i ein fil frå Gitea-repoet."""
|
||||
return _call_tool("get_file", {"path": path})
|
||||
|
||||
def list_open_issues() -> dict:
|
||||
"""List alle opne issues i OSVauco Gitea-repoet."""
|
||||
return _call_tool("list_open_issues", {})
|
||||
|
||||
def create_issue(title: str, body: str = "") -> dict:
|
||||
"""Opprett nytt issue i Gitea-repoet."""
|
||||
return _call_tool("create_issue", {"title": title, "body": body})
|
||||
|
||||
def push_file(path: str, content: str, message: str = "", sha: str = "") -> dict:
|
||||
"""Push/oppdater ein fil i Gitea."""
|
||||
return _call_tool("push_file", {"path": path, "content": content, "message": message, "sha": sha})
|
||||
|
||||
|
||||
OPAX_TOOLS = [
|
||||
FunctionTool(func=get_billing_summary), FunctionTool(func=get_billing_credits),
|
||||
FunctionTool(func=get_billing_anomalies), FunctionTool(func=get_billing_history),
|
||||
FunctionTool(func=get_billing_budget), FunctionTool(func=set_billing_budget),
|
||||
FunctionTool(func=create_invite), FunctionTool(func=list_customers),
|
||||
FunctionTool(func=send_webhook), FunctionTool(func=send_email),
|
||||
FunctionTool(func=get_notify_channels), FunctionTool(func=get_health),
|
||||
FunctionTool(func=get_build_status), FunctionTool(func=get_state),
|
||||
FunctionTool(func=get_telemetry), FunctionTool(func=run_terminal),
|
||||
FunctionTool(func=list_commits), FunctionTool(func=get_file),
|
||||
FunctionTool(func=list_open_issues), FunctionTool(func=create_issue),
|
||||
FunctionTool(func=get_billing_summary),
|
||||
FunctionTool(func=get_billing_credits),
|
||||
FunctionTool(func=get_billing_anomalies),
|
||||
FunctionTool(func=get_billing_history),
|
||||
FunctionTool(func=get_billing_budget),
|
||||
FunctionTool(func=set_billing_budget),
|
||||
FunctionTool(func=create_invite),
|
||||
FunctionTool(func=list_customers),
|
||||
FunctionTool(func=send_webhook),
|
||||
FunctionTool(func=send_email),
|
||||
FunctionTool(func=get_notify_channels),
|
||||
FunctionTool(func=get_health),
|
||||
FunctionTool(func=get_build_status),
|
||||
FunctionTool(func=get_state),
|
||||
FunctionTool(func=get_telemetry),
|
||||
FunctionTool(func=run_terminal),
|
||||
FunctionTool(func=list_commits),
|
||||
FunctionTool(func=get_file),
|
||||
FunctionTool(func=list_open_issues),
|
||||
FunctionTool(func=create_issue),
|
||||
FunctionTool(func=push_file),
|
||||
]
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Agent logic
|
||||
# ---------------------------------------------------------------------------
|
||||
def _normalize_mode(mode: str) -> str:
|
||||
mapping = {"A": "light", "A+": "heavy", "light": "light", "heavy": "heavy"}
|
||||
if mode not in mapping:
|
||||
raise ValueError(f"Invalid mode '{mode}'. Must be 'light' or 'heavy'.")
|
||||
return mapping[mode]
|
||||
|
||||
|
||||
def authorize_mode(user_id: str, mode: str) -> None:
|
||||
mode = _normalize_mode(mode)
|
||||
if mode == "heavy" and user_id not in HEAVY_MODE_ALLOWED_USERS:
|
||||
raise PermissionError(f"User '{user_id}' is not authorized for heavy mode.")
|
||||
|
||||
|
||||
def get_models_for_mode(mode: Mode) -> dict:
|
||||
if mode == "heavy":
|
||||
return {"orchestrator": HEAVY_ORCHESTRATOR, "subagent": HEAVY_SUBAGENT, "reasoning": HEAVY_REASONING, "budget_usd": BUDGET_HEAVY}
|
||||
return {"orchestrator": ORCHESTRATOR_MODEL, "subagent": SUBAGENT_MODEL, "reasoning": REASONING_MODEL, "budget_usd": BUDGET_LIGHT}
|
||||
|
||||
|
||||
_INSTRUCTION_TEMPLATE = (
|
||||
"Du er Jason Vauger — OPAX-agenten for Vauco AS. Modus: {mode}. Modell: {model}. "
|
||||
"Du har tilgang til alle OPAX-tools via opax-mcp. "
|
||||
"Tools: list_commits, get_file, push_file, create_issue, list_open_issues (Gitea), "
|
||||
"get_billing_summary, get_billing_credits, get_billing_anomalies, "
|
||||
"get_build_status, get_state, get_telemetry, run_terminal, "
|
||||
"create_invite, list_customers, send_webhook, send_email, get_notify_channels. "
|
||||
"Når brukaren ber om data — KALL ALLTID rett tool før du svarar. "
|
||||
"Svar på norsk (bokmål) med mindre annet er bedt om. "
|
||||
"HITL: ikkje kjør terraform/deploy utan godkjenning frå Chris."
|
||||
)
|
||||
|
||||
|
||||
def build_agent(mode: str = "light", message: str = "") -> tuple:
|
||||
mode = _normalize_mode(mode)
|
||||
models = get_models_for_mode(mode)
|
||||
actual_model = route_model(message=message, mode=mode, flash_model=ORCHESTRATOR_MODEL, pro_model=models["orchestrator"])
|
||||
instruction = _INSTRUCTION_TEMPLATE.format(mode=mode, model=actual_model)
|
||||
agent = Agent(model=actual_model, name="jason_vauger", description=f"Jason Vauger — OPAX enterprise agent [{mode}]", instruction=instruction, tools=OPAX_TOOLS)
|
||||
agent = Agent(
|
||||
model=actual_model,
|
||||
name="jason_vauger",
|
||||
description=f"Jason Vauger — OPAX enterprise agent [{mode}]",
|
||||
instruction=instruction,
|
||||
tools=OPAX_TOOLS,
|
||||
)
|
||||
return agent, actual_model, instruction
|
||||
|
||||
|
||||
root_agent, _, _ = build_agent(mode="light")
|
||||
|
||||
|
||||
async def _run_async(message: str, user_id: str, session_id: str, mode: str, caller_type: str = "agent") -> str:
|
||||
mode = _normalize_mode(mode)
|
||||
agent, actual_model, instruction = build_agent(mode=mode, message=message)
|
||||
module_name = f"jason/{mode}"
|
||||
|
||||
try:
|
||||
trim_context([types.Content(role="user", parts=[types.Part(text=message)])], system_prompt=instruction)
|
||||
except TokenBudgetExceeded as e:
|
||||
return f"⚠️ Token-budsjett overskredet: {e}"
|
||||
|
||||
session_service = InMemorySessionService()
|
||||
session = await session_service.create_session(app_name=APP_NAME, user_id=user_id, session_id=session_id)
|
||||
runner = Runner(agent=agent, app_name=APP_NAME, session_service=session_service)
|
||||
|
|
@ -204,6 +289,7 @@ async def _run_async(message: str, user_id: str, session_id: str, mode: str, cal
|
|||
input_tokens = 0
|
||||
output_tokens = 0
|
||||
request_id = str(uuid.uuid4())
|
||||
|
||||
async for event in runner.run_async(user_id=user_id, session_id=session.id, new_message=new_message):
|
||||
if event.is_final_response() and event.content and event.content.parts:
|
||||
final_text = event.content.parts[0].text or ""
|
||||
|
|
@ -211,15 +297,24 @@ async def _run_async(message: str, user_id: str, session_id: str, mode: str, cal
|
|||
um = event.usage_metadata
|
||||
input_tokens += getattr(um, "prompt_token_count", 0) or 0
|
||||
output_tokens += getattr(um, "candidates_token_count", 0) or 0
|
||||
|
||||
if input_tokens > 0 or output_tokens > 0:
|
||||
log_token_usage(agent_name=module_name, model_name=actual_model, input_tokens=input_tokens, output_tokens=output_tokens, request_id=request_id, module_name=module_name, caller_type=caller_type, session_id=session_id)
|
||||
log_token_usage(
|
||||
agent_name=module_name, model_name=actual_model,
|
||||
input_tokens=input_tokens, output_tokens=output_tokens,
|
||||
request_id=request_id, module_name=module_name,
|
||||
caller_type=caller_type, session_id=session_id,
|
||||
)
|
||||
logger.info(f"[agent] {mode}/{actual_model} in={input_tokens} out={output_tokens} caller={caller_type} session={session_id}")
|
||||
return final_text
|
||||
|
||||
|
||||
def run(message: str, user_id: str = "opax", session_id: str = "default", mode: str = "light", caller_type: str = "agent") -> str:
|
||||
mode = _normalize_mode(mode)
|
||||
authorize_mode(user_id, mode)
|
||||
return asyncio.run(_run_async(message=message, user_id=user_id, session_id=session_id, mode=mode, caller_type=caller_type))
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
import sys
|
||||
logging.basicConfig(level=logging.WARNING)
|
||||
|
|
|
|||
|
|
@ -1,39 +1,51 @@
|
|||
#!/usr/bin/env python3
|
||||
"""
|
||||
deploy_agent.py — Deploy ADK agent til Vertex AI Agent Engine
|
||||
Usage: python3 deploy_agent.py [--project PROJECT_ID] [--region REGION] \
|
||||
[--display-name DISPLAY_NAME] [--staging-bucket GS_URI]
|
||||
|
||||
Krever: google-cloud-aiplatform>=1.157.0, google-adk>=2.0.0
|
||||
"""
|
||||
|
||||
import argparse
|
||||
import sys
|
||||
from pathlib import Path
|
||||
import vertexai
|
||||
from vertexai import agent_engines
|
||||
from vertexai import agent_engines # riktig import for SDK >= 1.157.0
|
||||
|
||||
def deploy(project, region, display_name, staging_bucket):
|
||||
|
||||
def deploy(project: str, region: str, display_name: str, staging_bucket: str):
|
||||
print(f"Initialiserer Vertex AI: project={project}, region={region}")
|
||||
vertexai.init(project=project, location=region, staging_bucket=staging_bucket)
|
||||
|
||||
base_dir = Path(__file__).resolve().parent
|
||||
sys.path.insert(0, str(base_dir))
|
||||
# Importer Jason ADK agent
|
||||
sys.path.insert(0, ".")
|
||||
import agent as my_agent
|
||||
|
||||
import agent as _agent_module
|
||||
root_agent = _agent_module.root_agent
|
||||
|
||||
print(f"Deployer agent '{display_name}'...")
|
||||
remote = agent_engines.create(
|
||||
root_agent,
|
||||
print(f"Deployer agent '{display_name}' til Vertex AI Agent Engine i {region}...")
|
||||
remote_agent = agent_engines.create(
|
||||
my_agent.root_agent,
|
||||
requirements=[
|
||||
"google-cloud-aiplatform[adk,agent_engines]>=1.157.0",
|
||||
"google-adk>=2.2.0",
|
||||
"httpx>=0.27.0",
|
||||
"google-auth>=2.29.0",
|
||||
],
|
||||
extra_packages=[str(base_dir / "agent.py")],
|
||||
extra_packages=["./opax_mcp_client.py"],
|
||||
display_name=display_name,
|
||||
)
|
||||
print(f"\n✅ Agent deployet!\n Resource name: {remote.resource_name}")
|
||||
print(f"\n✅ Agent deployet!")
|
||||
print(f" Resource name : {remote_agent.resource_name}")
|
||||
print(f" Console : https://console.cloud.google.com/ai/agents?project={project}")
|
||||
print(f" Region : {region}")
|
||||
print("\n⚠️ Husk: kjør teardown når du er ferdig for å unngå unnødige kostnader.")
|
||||
return remote_agent
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
parser = argparse.ArgumentParser()
|
||||
parser = argparse.ArgumentParser(description="Deploy Jason ADK agent til Vertex AI")
|
||||
parser.add_argument("--project", default="propane-will-491900-m5")
|
||||
parser.add_argument("--region", default="us-central1")
|
||||
parser.add_argument("--display-name", default="jason-vauger-v12")
|
||||
parser.add_argument("--display-name", default="jason-vauger-v1")
|
||||
parser.add_argument("--staging-bucket", default="gs://propane-will-491900-m5-agent-staging")
|
||||
args = parser.parse_args()
|
||||
deploy(args.project, args.region, args.display_name, args.staging_bucket)
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
"""
|
||||
opax_mcp_client.py — REST-klient for opax-mcp Cloud Run service.
|
||||
Kopiert inn i core-logic/ slik at Vertex AI Agent Engine finn den ved deploy.
|
||||
opax_mcp_client — REST-klient for opax-mcp Cloud Run service.
|
||||
Pakke-struktur for Vertex AI Agent Engine extra_packages-kompatibilitet.
|
||||
|
||||
Auth-lag:
|
||||
1. Cloud Run IAM : Authorization: Bearer <identity-token> (automatisk)
|
||||
|
|
|
|||
194
docs/HANDOFF.md
194
docs/HANDOFF.md
|
|
@ -1,29 +1,6 @@
|
|||
# HANDOFF — 2026-06-19
|
||||
|
||||
## Status
|
||||
Deploy SUCCESS kl 23:10 CEST — build 6af0bb06
|
||||
|
||||
## Problem løst
|
||||
OPAX-hub (opax.vauco.no) hadde ikke-fungerende chat, panel-switching og suggest-knapper.
|
||||
|
||||
## Rot-årsak
|
||||
Alle fetch()-kall manglet `credentials: 'include'` — IAP-cookies ble ikke sendt med API-requests.
|
||||
|
||||
## Fix
|
||||
Lagt til `credentials: 'include'` i:
|
||||
- fetchWithTimeout() — linje 804
|
||||
- sendMessage() fetch til /run — linje 1102
|
||||
- termKey() fetch til /terminal/exec — linje 1050
|
||||
|
||||
## Neste sesjon
|
||||
- Verifiser at Jason-chat fungerer med IAP-auth i nettleser
|
||||
- Sjekk at panel-switching og build-status oppdateres korrekt
|
||||
|
||||
---
|
||||
|
||||
# HANDOFF — Vauco OS
|
||||
|
||||
**Sist oppdatert:** 2026-06-15 19:46 CEST
|
||||
**Sist oppdatert:** 2026-06-18 14:00 CEST
|
||||
**Skrevet av:** Perplexity (Orchestrator)
|
||||
**Status:** Fase B — Gitea er primær Git. GitHub er fasa ut.
|
||||
|
||||
|
|
@ -31,7 +8,7 @@ Lagt til `credentials: 'include'` i:
|
|||
|
||||
## ⚠️ KRITISKE REGLER — les alltid først
|
||||
|
||||
- **Hovudapp:** `main.py` i rot — IKKJE `agents/core-logic/app.py`
|
||||
- **Hovedapp:** `main.py` i rot — IKKJE `agents/core-logic/app.py`
|
||||
- **Dockerfile:** `agents/core-logic/Dockerfile` — WORKDIR `/app`, CMD uvicorn main:app
|
||||
- **Region:** `us-central1` | **Service:** `osvauco-agent` | **Prosjekt:** `propane-will-491900-m5`
|
||||
- **Test via proxy:** `gcloud run services proxy osvauco-agent --region us-central1 --project propane-will-491900-m5 --port 8181`
|
||||
|
|
@ -44,7 +21,20 @@ Lagt til `credentials: 'include'` i:
|
|||
|
||||
---
|
||||
|
||||
## ✅ Fullført i dag (2026-06-15)
|
||||
## ✅ Fullført i dag (2026-06-18) — IAP Auth fix for opax-mcp
|
||||
|
||||
| Oppgave | Status |
|
||||
|---------|--------|
|
||||
| Identifisert rotårsak: feil IAP audience i identity token-kall | ✅ |
|
||||
| Lagt til `roles/iap.httpsResourceAccessor` for `jason-vauger` SA | ✅ |
|
||||
| Oppdatert `opax-mcp/server.py` — ny env var `OPAX_IAP_CLIENT_ID` som audience | ✅ |
|
||||
| Lagt til `OPAX_IAP_CLIENT_ID` env var i Cloud Run (revisjon 00019 — feil navn `IAP_CLIENT_ID`) | ⚠️ |
|
||||
| Rettet env var navn til `OPAX_IAP_CLIENT_ID` i Cloud Run — revisjon 00020 deployed | ✅ |
|
||||
| Revisjon `opax-mcp-00020-w6j` aktiv med 100% trafikk | ✅ |
|
||||
|
||||
---
|
||||
|
||||
## ✅ Fullført tidligere (2026-06-15)
|
||||
|
||||
| Oppgave | Status |
|
||||
|---------|--------|
|
||||
|
|
@ -53,7 +43,7 @@ Lagt til `credentials: 'include'` i:
|
|||
| Jason deployet til Vertex AI Agent Engine | ✅ |
|
||||
| Jason svarer på norsk og kallar tools automatisk | ✅ |
|
||||
| Gitea installert på VM (`34.59.131.162:3000`) | ✅ |
|
||||
| Gitea køyrer som systemd-teneste (overlever reboot) | ✅ |
|
||||
| Gitea kjøyrer som systemd-teneste (overlever reboot) | ✅ |
|
||||
| Mirror-repo sletta og erstatta med vanleg repo | ✅ |
|
||||
| **2867 commits pusha frå GitHub → Gitea** | ✅ |
|
||||
| Gitea API-tokens i Secret Manager | ✅ |
|
||||
|
|
@ -61,92 +51,116 @@ Lagt til `credentials: 'include'` i:
|
|||
|
||||
---
|
||||
|
||||
## 🏗 Systemstatus
|
||||
## 🖥 Systemstatus
|
||||
|
||||
| Komponent | URL / Referanse | Status |
|
||||
|-----------|-----------------|--------|
|
||||
| `osvauco-agent` Cloud Run | `us-central1` | ✅ Live |
|
||||
| `opax-mcp` Cloud Run | `https://opax-mcp-zjbqp3prqq-uc.a.run.app` | ✅ Live (25 tools) |
|
||||
| Jason Vertex AI Agent Engine | `reasoningEngines/237959055262351360` | ✅ Live |
|
||||
| **Gitea (primær Git)** | `http://34.59.131.162:3000/chris/OSVauco` | ✅ Live + systemd |
|
||||
| GitHub OSVauco | `https://github.com/vauco-saas/OSVauco` | ❌ Fasa ut |
|
||||
| `opax.vauco.no` | — | ✅ Live |
|
||||
| Emma (Gemma, lokal VM) | — | ⏳ Neste fase |
|
||||
| osvauco-agent (Cloud Run) | https://osvauco-agent-zjbgp3prqg-uc.a.run.app | ✅ Live |
|
||||
| opax-mcp (Cloud Run) | https://opax-mcp-357036551735.us-central1.run.app | ✅ Live (rev 00020) |
|
||||
| opax frontend (IAP LB) | https://opax.vauco.no | ✅ Live |
|
||||
| Jason (Vertex AI Agent) | Agent Engine, us-central1 | ✅ Live |
|
||||
| Gitea (self-hosted) | http://34.59.131.162:3000 | ✅ Live |
|
||||
| GitHub (legacy) | https://github.com/vauco-saas/OSVauco | ⚠️ Fasa ut |
|
||||
|
||||
---
|
||||
|
||||
## 🔑 Credentials
|
||||
|
||||
| System | Brukar | Verdi |
|
||||
|--------|--------|-------|
|
||||
| Gitea | `chris` | `OSVauco@Gitea2026!` |
|
||||
| Gitea API token (jason-token2) | — | Secret Manager: `gitea-api-token` (`278c0b41...`) |
|
||||
| Gitea API token (admin-token2) | — | `94527a0f5353c4b1db29a007b98f340b5fd1f385` |
|
||||
| opax-mcp MCP_SECRET | — | Secret Manager: `mcp-server-key` |
|
||||
| Jason Agent Engine | — | `reasoningEngines/237959055262351360` |
|
||||
- **Gitea login:** `chris` / se Secret Manager
|
||||
- **Gitea API-token:** Secret Manager → `gitea-api-token`
|
||||
- **MCP-Secret:** Secret Manager → `mcp-secret`
|
||||
- **Prosjekt:** `propane-will-491900-m5`
|
||||
- **IAP OAuth Client ID (opax backend):** `357036551735-kq8nt71d38hfqlcfb3n52ef7ala4meo.apps.googleusercontent.com`
|
||||
- **IAP Backend Service path:** `/projects/357036551735/global/backendServices/<navn>` (satt som `OPAX_IAP_CLIENT_ID` i Cloud Run)
|
||||
|
||||
---
|
||||
|
||||
## 🟠 Gjenstår (prioritert)
|
||||
## 🎯 Gjenstår (prioritert)
|
||||
|
||||
| # | Oppgave | Notat |
|
||||
|---|---------|-------|
|
||||
| 1 | Oppdater `opax_mcp_client.py` GitHub-tools → Gitea API | Byt `api.github.com` → `34.59.131.162:3000/api/v1` |
|
||||
| 2 | Cloud Build webhook → Gitea (ikkje GitHub) | Trigger på Gitea push |
|
||||
| 3 | DNS `git.vauco.no` → `34.59.131.162` | Domene for Gitea |
|
||||
| 4 | HTTPS/TLS for Gitea (Caddy) | Etter DNS |
|
||||
| 5 | Emma — Gemma lokal på ML-3a GPU VM | Eiga fase |
|
||||
| 6 | Sett manglande env-vars på `osvauco-agent` | `SENDGRID_API_KEY`, `TWILIO_*`, `NOTIFY_*` |
|
||||
1. **KRITISK — Verifiser IAP auth end-to-end** — kjør verifikasjonskommando under og bekreft `HTTP/2 200`
|
||||
2. Oppdater Gitea-klient-logikk i agenter (fra GitHub API → Gitea API)
|
||||
3. DNS/TLS for Gitea (`git.vauco.no`)
|
||||
4. GPU VM-arbeid (planlagt)
|
||||
5. Smoke-test pipeline for opax-mcp etter IAP-fix
|
||||
|
||||
---
|
||||
|
||||
## 📌 Neste sesjon — start her
|
||||
## 🚀 Neste sesjon — start her
|
||||
|
||||
### 1. Verifiser IAP auth fix (VIKTIGST)
|
||||
|
||||
Kjør fra `osvauco-dev-vm`:
|
||||
|
||||
```bash
|
||||
# 1. Verifiser Gitea
|
||||
curl -s http://34.59.131.162:3000/api/v1/repos/chris/OSVauco
|
||||
-H "Authorization: token 94527a0f5353c4b1db29a007b98f340b5fd1f385"
|
||||
| python3 -c "import sys,json; r=json.load(sys.stdin); print('mirror:', r['mirror'], '| commits OK')"
|
||||
# Hent identity token med korrekt IAP audience
|
||||
TOKEN=$(curl -s -H "Metadata-Flavor: Google" \
|
||||
"http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=357036551735-kq8nt71d38hfqlcfb3n52ef7ala4meo.apps.googleusercontent.com&format=full")
|
||||
|
||||
# 2. Verifiser Jason
|
||||
cd ~/OSVauco/agents/core-logic && source .venv/bin/activate
|
||||
python3 - <<'EOF'
|
||||
import vertexai
|
||||
from vertexai import agent_engines
|
||||
vertexai.init(project="propane-will-491900-m5", location="us-central1")
|
||||
agent = agent_engines.get("projects/357036551735/locations/us-central1/reasoningEngines/237959055262351360")
|
||||
session = agent.create_session(user_id="chris")
|
||||
for event in agent.stream_query(user_id="chris", session_id=session["id"], message="Status?"):
|
||||
if event.get("content"):
|
||||
print(event["content"]["parts"][0].get("text", ""), end="")
|
||||
EOF
|
||||
|
||||
# 3. Neste: oppdater opax_mcp_client.py til Gitea API
|
||||
# Test mot opax via IAP load balancer
|
||||
curl -si https://opax.vauco.no/opax/build-status \
|
||||
-H "Authorization: Bearer $TOKEN" | head -5
|
||||
```
|
||||
|
||||
Forventet: `HTTP/2 200` (tidligere: `HTTP/2 401`)
|
||||
|
||||
### 2. Sjekk Jason sin status
|
||||
|
||||
```bash
|
||||
curl -s https://osvauco-agent-zjbgp3prqg-uc.a.run.app/health \
|
||||
-H "Authorization: Bearer $(gcloud auth print-identity-token)"
|
||||
```
|
||||
|
||||
### 3. Hva som ble fikset i opax-mcp/server.py
|
||||
|
||||
**Fil:** `opax-mcp/server.py` — commit `9542106` ("OPAX_IAP_CLIENT_ID som IAP audience i identitytoken")
|
||||
|
||||
**Endring linje 17:**
|
||||
```python
|
||||
# FØR:
|
||||
OPAX_BASE_URL = os.environ.get("OPAX_BASE_URL", "https://opax.vauco.no")
|
||||
|
||||
# ETTER:
|
||||
OPAX_BASE_URL = os.environ.get("OPAX_BASE_URL", "https://opax.vauco.no")
|
||||
OPAX_IAP_CLIENT_ID = os.environ.get("OPAX_IAP_CLIENT_ID", "")
|
||||
```
|
||||
|
||||
**Endring linje 37 (`_opax_identity_token`):**
|
||||
```python
|
||||
# FØR:
|
||||
f"...identity?audience={OPAX_BASE_URL}&format=full"
|
||||
|
||||
# ETTER:
|
||||
f"...identity?audience={OPAX_IAP_CLIENT_ID or OPAX_BASE_URL}&format=full"
|
||||
```
|
||||
|
||||
**Cloud Run env vars på opax-mcp (aktive i rev 00020):**
|
||||
|
||||
| Navn | Verdi |
|
||||
|------|-------|
|
||||
| `OPAX_BASE_URL` | `https://opax.vauco.no` |
|
||||
| `OPAX_IAP_CLIENT_ID` | `/projects/357036551735/global/backendServices/...` |
|
||||
| `MCP_SECRET` | (fra Secret Manager) |
|
||||
| `GOOGLE_CLOUD_PROJECT` | `propane-will-491900-m5` |
|
||||
|
||||
---
|
||||
|
||||
## 🗺 Arkitektur
|
||||
## 🏗 Arkitektur
|
||||
|
||||
```
|
||||
Chris (naturleg språk)
|
||||
↓
|
||||
Jason Vauger (Vertex AI Agent Engine — Gemini 2.5 Flash)
|
||||
reasoningEngines/237959055262351360
|
||||
↓
|
||||
opax-mcp (Cloud Run — 25 tools)
|
||||
https://opax-mcp-zjbqp3prqq-uc.a.run.app
|
||||
↓
|
||||
┌─────────────────────────────────┐
|
||||
│ Gitea 34.59.131.162:3000 │ ← Eigen Git (PRIMÆR)
|
||||
│ GCP Cloud Build / Run │ ← CI/CD + hosting
|
||||
│ GitHub — FASA UT │ ← Ikkje i bruk lenger
|
||||
└─────────────────────────────────┘
|
||||
Bruker
|
||||
└─► Jason (Vertex AI Agent Engine, Gemini 2.5 Pro)
|
||||
└─► osvauco-agent (Cloud Run)
|
||||
└─► opax-mcp (Cloud Run)
|
||||
└─► [IAP] opax.vauco.no
|
||||
└─► OPAX backend (GCP)
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
*Jason Vauger — han blir den du trenger han til å bli.*
|
||||
|
||||
## NESTE OPPGAVE
|
||||
Verifiser full agent-loop: Jason mottar spørsmål → kaller opax-mcp → får svar fra opax.vauco.no uten feil.
|
||||
**Auth-flyt for opax-mcp → opax.vauco.no:**
|
||||
```
|
||||
opax-mcp container
|
||||
→ GCE Metadata Service
|
||||
→ identity token med audience = IAP_CLIENT_ID
|
||||
→ Authorization: Bearer <token>
|
||||
→ IAP validerer token
|
||||
→ Request videresendt til OPAX backend
|
||||
```
|
||||
|
|
|
|||
|
|
@ -5,6 +5,8 @@ Auth: Cloud Run IAM (Authorization header) + X-MCP-Secret header for tool-level
|
|||
import os
|
||||
import httpx
|
||||
import base64
|
||||
import google.auth
|
||||
import google.auth.transport.requests
|
||||
from fastapi import FastAPI, HTTPException, Header
|
||||
from pydantic import BaseModel
|
||||
from typing import Optional, Any
|
||||
|
|
@ -12,16 +14,7 @@ from typing import Optional, Any
|
|||
app = FastAPI(title="opax-mcp", version="2.0.0")
|
||||
|
||||
OPAX_BASE_URL = os.environ.get("OPAX_BASE_URL", "https://opax.vauco.no")
|
||||
IAP_CLIENT_ID = os.environ.get("IAP_CLIENT_ID", "357036551735-kq8nt7ld38hfqlcfb3n52ef7tala4meo.apps.googleusercontent.com")
|
||||
|
||||
async def _iap_token() -> str:
|
||||
"""Fetch IAP identity token from GCP metadata server."""
|
||||
url = (f"http://metadata.google.internal/computeMetadata/v1/instance/"
|
||||
f"service-accounts/default/identity?audience={IAP_CLIENT_ID}&format=full")
|
||||
async with httpx.AsyncClient(timeout=10) as c:
|
||||
r = await c.get(url, headers={"Metadata-Flavor": "Google"})
|
||||
r.raise_for_status()
|
||||
return r.text.strip()
|
||||
OPAX_IAP_CLIENT_ID = os.environ.get("OPAX_IAP_CLIENT_ID", "")
|
||||
MCP_SECRET = os.environ.get("MCP_SECRET", "")
|
||||
|
||||
# Gitea
|
||||
|
|
@ -37,6 +30,30 @@ def _auth_check(x_mcp_secret: Optional[str]):
|
|||
raise HTTPException(status_code=401, detail="Unauthorized")
|
||||
|
||||
|
||||
def _opax_identity_token() -> str:
|
||||
"""Hent identity token for opax.vauco.no (Cloud Run IAP/IAM)."""
|
||||
metadata_url = (
|
||||
"http://metadata.google.internal/computeMetadata/v1/instance"
|
||||
f"/service-accounts/default/identity?audience={OPAX_IAP_CLIENT_ID or OPAX_BASE_URL}&format=full"
|
||||
)
|
||||
try:
|
||||
resp = httpx.get(metadata_url, headers={"Metadata-Flavor": "Google"}, timeout=5)
|
||||
if resp.status_code == 200 and resp.text.strip():
|
||||
return resp.text.strip()
|
||||
except Exception:
|
||||
pass
|
||||
credentials, _ = google.auth.default()
|
||||
credentials.refresh(google.auth.transport.requests.Request())
|
||||
return credentials.token
|
||||
|
||||
|
||||
def _opax_headers() -> dict:
|
||||
return {
|
||||
"Authorization": f"Bearer {_opax_identity_token()}",
|
||||
"Content-Type": "application/json",
|
||||
}
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Health
|
||||
# ---------------------------------------------------------------------------
|
||||
|
|
@ -79,19 +96,15 @@ async def list_tools(x_mcp_secret: Optional[str] = Header(default=None)):
|
|||
# ---------------------------------------------------------------------------
|
||||
|
||||
async def _opax_get(path: str) -> Any:
|
||||
token = await _iap_token()
|
||||
async with httpx.AsyncClient(timeout=30) as client:
|
||||
r = await client.get(f"{OPAX_BASE_URL}{path}",
|
||||
headers={"Authorization": f"Bearer {token}"})
|
||||
r = await client.get(f"{OPAX_BASE_URL}{path}", headers=_opax_headers())
|
||||
r.raise_for_status()
|
||||
return r.json()
|
||||
|
||||
|
||||
async def _opax_post(path: str, body: dict) -> Any:
|
||||
token = await _iap_token()
|
||||
async with httpx.AsyncClient(timeout=30) as client:
|
||||
r = await client.post(f"{OPAX_BASE_URL}{path}", json=body,
|
||||
headers={"Authorization": f"Bearer {token}"})
|
||||
r = await client.post(f"{OPAX_BASE_URL}{path}", json=body, headers=_opax_headers())
|
||||
r.raise_for_status()
|
||||
return r.json()
|
||||
|
||||
|
|
@ -217,7 +230,7 @@ async def run_emma(p):
|
|||
# Platform tools
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
async def get_health(p): return await _opax_get("/health")
|
||||
async def get_health(p): return await _opax_get("/health")
|
||||
async def get_build_status(p): return await _opax_get("/opax/build-status")
|
||||
async def get_state(p): return await _opax_get("/state")
|
||||
async def get_telemetry(p): return await _opax_get("/telemetry/history")
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user