create-loopengine 0.1.11 → 0.1.12

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { cpSync, existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
+import { cpSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 // Template ships in `template/` next to `dist/`, not inside it — it's a
@@ -15,6 +15,10 @@ export function scaffold(options) {
     }
     mkdirSync(destination, { recursive: true });
     cpSync(templateDir, destination, { recursive: true });
+    // npm strips any .gitignore (even nested ones) when publishing a package,
+    // so the template ships it as `_gitignore` and this renames it back —
+    // same workaround create-vite/create-react-app use for the same reason.
+    renameSync(join(destination, '_gitignore'), join(destination, '.gitignore'));
     const pkgPath = join(destination, 'package.json');
     const pkg = readFileSync(pkgPath, 'utf8').replace('__PROJECT_NAME__', name);
     writeFileSync(pkgPath, pkg);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-loopengine",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "Scaffold a new loopengine agent project — a runnable HTTP server with one example agent, in your own repo.",
   "license": "MIT",
   "type": "module",

package/template/_gitignore

@@ -0,0 +1,6 @@
+node_modules
+dist
+.sessions
+.env
+*.log
+.DS_Store

package/template/adapters/http.ts

@@ -29,11 +29,17 @@
 // file's call — see AgentConfig.sessionIdFor and defaultSessionIdFor below.
 import { randomUUID, timingSafeEqual } from 'node:crypto'
 import { createServer, type IncomingMessage, type ServerResponse } from 'node:http'
+import { pathToFileURL } from 'node:url'
 import { getEntry, listAgents, projectDir, registerAgent, updateAgent, type RegistryEntry } from '../agent-registry.js'
 import {
   loadAgentModule,
   synthesizeCreateModelCall,
   editAgentFile,
+  createHttpTool,
+  HttpToolNameError,
+  HttpToolExistsError,
+  HttpToolIndexShapeError,
+  type HttpToolSpec,
   AgentEditNotSupportedError,
   AgentFileNotFoundError,
   type AgentEditResult,
@@ -441,6 +447,105 @@ async function handleGatewayToolSlugDelete(res: ServerResponse, agentName: strin
   res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ sources }))
 }
 
+function parseHttpToolBody(body: Record<string, unknown>): { ok: true; value: HttpToolSpec; decision?: Decision } | { ok: false; error: string } {
+  if (typeof body.name !== 'string' || !body.name) return { ok: false, error: 'name is required' }
+  if (typeof body.description !== 'string' || !body.description) return { ok: false, error: 'description is required' }
+  if (!Array.isArray(body.fields) || !body.fields.every((f) => f && typeof f === 'object')) {
+    return { ok: false, error: 'fields must be an array' }
+  }
+  const fields = body.fields as Record<string, unknown>[]
+  for (const f of fields) {
+    if (typeof f.name !== 'string' || !f.name) return { ok: false, error: 'every field needs a name' }
+    if (f.type !== 'string' && f.type !== 'number' && f.type !== 'boolean') return { ok: false, error: `field "${f.name}" has an invalid type` }
+  }
+  const method = body.method
+  if (method !== 'GET' && method !== 'POST' && method !== 'PUT' && method !== 'PATCH' && method !== 'DELETE') {
+    return { ok: false, error: 'method must be one of GET, POST, PUT, PATCH, DELETE' }
+  }
+  if (typeof body.url !== 'string' || !body.url) return { ok: false, error: 'url is required' }
+  if (!Array.isArray(body.headers) || !body.headers.every((h) => h && typeof h === 'object' && typeof (h as Record<string, unknown>).key === 'string' && typeof (h as Record<string, unknown>).value === 'string')) {
+    return { ok: false, error: 'headers must be an array of {key, value} strings' }
+  }
+  if (body.responseJsonPath !== undefined && typeof body.responseJsonPath !== 'string') {
+    return { ok: false, error: 'responseJsonPath must be a string' }
+  }
+  if (body.decision !== undefined && !isDecision(body.decision)) {
+    return { ok: false, error: 'decision must be allow, ask, or deny' }
+  }
+
+  return {
+    ok: true,
+    value: {
+      name: body.name,
+      description: body.description,
+      fields: fields as unknown as HttpToolSpec['fields'],
+      method,
+      url: body.url,
+      headers: body.headers as HttpToolSpec['headers'],
+      sendFieldsAsJsonBody: body.sendFieldsAsJsonBody === true,
+      responseJsonPath: body.responseJsonPath as string | undefined,
+    },
+    decision: body.decision as Decision | undefined,
+  }
+}
+
+// Backs the Tools tab's "Create an HTTP tool" form — generates a real
+// agents/:name/tools/<tool>.ts file (loopengine's own createHttpTool),
+// then splices the freshly-imported ToolDefinition straight into this
+// process's own live registry via updateAgent (../agent-registry.js) —
+// the same "no restart needed" mechanism a newly-created agent already
+// gets (see registerAgent's own doc comment), and deliberately not a
+// reliance on tsx watch picking up the new file: this way the tool is
+// callable immediately under `serve` (no watch) too, not just `dev`. An
+// optional `decision` seeds one actauth.yml rule via the already-existing
+// addActauthRule, mirroring gateway-tools.ts's own "a rule is opt-in,
+// omitting it falls through to default_decision" precedent — never a
+// hardcoded default here.
+async function handleHttpToolPost(req: IncomingMessage, res: ServerResponse, agentName: string): Promise<void> {
+  const entry = getEntry(agentName)
+  if (!entry) {
+    res.writeHead(404, { 'content-type': 'application/json' }).end(JSON.stringify({ error: `unknown agent '${agentName}'` }))
+    return
+  }
+  const body = await readJsonBody(req)
+  const parsed = parseHttpToolBody(body)
+  if (!parsed.ok) {
+    res.writeHead(400, { 'content-type': 'application/json' }).end(JSON.stringify({ error: parsed.error }))
+    return
+  }
+
+  let tool: ToolDefinition
+  try {
+    const result = await createHttpTool(agentName, parsed.value)
+    tool = result.tool
+  } catch (err) {
+    const status = err instanceof HttpToolExistsError ? 409 : err instanceof HttpToolNameError || err instanceof HttpToolIndexShapeError ? 400 : 500
+    res.writeHead(status, { 'content-type': 'application/json' }).end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }))
+    return
+  }
+
+  const currentTools = entry.config.tools ?? (await loadDefaultTools(entry.config))
+  updateAgent(agentName, { config: { tools: [...currentTools, tool] } })
+
+  if (parsed.decision) {
+    try {
+      addActauthRule(agentName, { name: `${parsed.value.name}-admin-created`, scope: '*/*', tool: parsed.value.name, decision: parsed.decision })
+    } catch (err) {
+      // The tool file and live registration above already succeeded —
+      // a rule-seeding failure (near-impossible: only real cause is a
+      // same-named rule already existing) shouldn't roll either back,
+      // just surface as a warning-shaped success so the operator can
+      // add the rule by hand via the Actauth tab instead.
+      res.writeHead(200, { 'content-type': 'application/json' }).end(
+        JSON.stringify({ tool: describeTool(tool), ruleWarning: err instanceof Error ? err.message : String(err) }),
+      )
+      return
+    }
+  }
+
+  res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ tool: describeTool(tool) }))
+}
+
 // Backs GET /composio/connections and GET /composio/tools — not scoped
 // under /agents/:name/ like the routes above, deliberately: which apps
 // are connected and what they offer isn't a property of any one agent,
@@ -1779,6 +1884,12 @@ const server = createServer(async (req, res) => {
       return
     }
 
+    const httpToolMatch = req.method === 'POST' && pathname.match(/^\/agents\/([^/]+)\/tools\/http$/)
+    if (httpToolMatch) {
+      await handleHttpToolPost(req, res, decodeURIComponent(httpToolMatch[1]))
+      return
+    }
+
     // Backs the Skills tab's edit form — see skills-admin.ts for why
     // :skillId is restricted to a flat (non-nested) id.
     const skillMatch = pathname.match(/^\/agents\/([^/]+)\/skills\/([^/]+)$/)