create-loopengine 0.1.11 → 0.1.13

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { cpSync, existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
+import { cpSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 // Template ships in `template/` next to `dist/`, not inside it — it's a
@@ -15,6 +15,10 @@ export function scaffold(options) {
     }
     mkdirSync(destination, { recursive: true });
     cpSync(templateDir, destination, { recursive: true });
+    // npm strips any .gitignore (even nested ones) when publishing a package,
+    // so the template ships it as `_gitignore` and this renames it back —
+    // same workaround create-vite/create-react-app use for the same reason.
+    renameSync(join(destination, '_gitignore'), join(destination, '.gitignore'));
     const pkgPath = join(destination, 'package.json');
     const pkg = readFileSync(pkgPath, 'utf8').replace('__PROJECT_NAME__', name);
     writeFileSync(pkgPath, pkg);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-loopengine",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "Scaffold a new loopengine agent project — a runnable HTTP server with one example agent, in your own repo.",
   "license": "MIT",
   "type": "module",

package/template/_gitignore

@@ -0,0 +1,6 @@
+node_modules
+dist
+.sessions
+.env
+*.log
+.DS_Store

package/template/adapters/http.ts

@@ -29,14 +29,21 @@
 // file's call — see AgentConfig.sessionIdFor and defaultSessionIdFor below.
 import { randomUUID, timingSafeEqual } from 'node:crypto'
 import { createServer, type IncomingMessage, type ServerResponse } from 'node:http'
+import { pathToFileURL } from 'node:url'
 import { getEntry, listAgents, projectDir, registerAgent, updateAgent, type RegistryEntry } from '../agent-registry.js'
 import {
   loadAgentModule,
   synthesizeCreateModelCall,
   editAgentFile,
+  createHttpTool,
+  HttpToolNameError,
+  HttpToolExistsError,
+  HttpToolIndexShapeError,
+  type HttpToolSpec,
   AgentEditNotSupportedError,
   AgentFileNotFoundError,
   type AgentEditResult,
+  type AgentEditableFields,
   createSessionStore,
   createCheckpointStore,
   type TurnCheckpoint,
@@ -73,6 +80,10 @@ import {
   deleteSkill,
   SkillInvalidIdError,
   SkillNotFoundError,
+  listSkillgardenCatalog,
+  readSkillgardenCatalogEntry,
+  addSkillgardenSkillToAgent,
+  SkillgardenUnavailableError,
   readActauthConfig,
   addActauthRule,
   updateActauthRule,
@@ -308,9 +319,14 @@ async function describeAgent(entry: RegistryEntry): Promise<Record<string, unkno
   // configured for *this* agent, so the config page's own Skills tab
   // deliberately doesn't mix it into skills/skillsDirs below.
   const skillsDirs = config.skillsDirs ?? [`agents/${config.name}/skills`]
-  const skillGarden = new SkillGarden({ dirs: skillsDirs, indexBudgetTokens: config.skillIndexBudgetTokens ?? 200 })
+  // Same defaults, same reasoning, as loopengine's own run-agent.ts
+  // SkillGarden/BudgetTracker construction — kept in sync there and here
+  // since this is what a "Skills"/"Limits & budgets" tab shows an
+  // operator, and it has to describe what runAgent() would actually
+  // resolve, not a second guess (see this function's own header comment).
+  const skillGarden = new SkillGarden({ dirs: skillsDirs, indexBudgetTokens: config.skillIndexBudgetTokens ?? 2000 })
   const skillIndex = skillGarden.buildIndex().included
-  const systemSkillGarden = new SkillGarden({ dirs: [systemSkillsDir], indexBudgetTokens: config.skillIndexBudgetTokens ?? 200 })
+  const systemSkillGarden = new SkillGarden({ dirs: [systemSkillsDir], indexBudgetTokens: config.skillIndexBudgetTokens ?? 2000 })
   const systemSkillIndex = systemSkillGarden.buildIndex().included
 
   return {
@@ -320,8 +336,8 @@ async function describeAgent(entry: RegistryEntry): Promise<Record<string, unkno
       ? { provider: config.model.provider, model: config.model.model, maxTokens: config.model.maxTokens }
       : 'custom (module exports its own createModelCall)',
     maxTurns: config.maxTurns ?? 25,
-    contextBudgetTokens: config.contextBudgetTokens ?? 8000,
-    skillIndexBudgetTokens: config.skillIndexBudgetTokens ?? 200,
+    contextBudgetTokens: config.contextBudgetTokens ?? 100000,
+    skillIndexBudgetTokens: config.skillIndexBudgetTokens ?? 2000,
     skillsDirs: skillsDirs,
     skills: skillIndex.map((s) => ({ name: s.name, description: s.description })),
     systemSkills: systemSkillIndex.map((s) => ({ name: s.name, description: s.description })),
@@ -441,6 +457,105 @@ async function handleGatewayToolSlugDelete(res: ServerResponse, agentName: strin
   res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ sources }))
 }
 
+function parseHttpToolBody(body: Record<string, unknown>): { ok: true; value: HttpToolSpec; decision?: Decision } | { ok: false; error: string } {
+  if (typeof body.name !== 'string' || !body.name) return { ok: false, error: 'name is required' }
+  if (typeof body.description !== 'string' || !body.description) return { ok: false, error: 'description is required' }
+  if (!Array.isArray(body.fields) || !body.fields.every((f) => f && typeof f === 'object')) {
+    return { ok: false, error: 'fields must be an array' }
+  }
+  const fields = body.fields as Record<string, unknown>[]
+  for (const f of fields) {
+    if (typeof f.name !== 'string' || !f.name) return { ok: false, error: 'every field needs a name' }
+    if (f.type !== 'string' && f.type !== 'number' && f.type !== 'boolean') return { ok: false, error: `field "${f.name}" has an invalid type` }
+  }
+  const method = body.method
+  if (method !== 'GET' && method !== 'POST' && method !== 'PUT' && method !== 'PATCH' && method !== 'DELETE') {
+    return { ok: false, error: 'method must be one of GET, POST, PUT, PATCH, DELETE' }
+  }
+  if (typeof body.url !== 'string' || !body.url) return { ok: false, error: 'url is required' }
+  if (!Array.isArray(body.headers) || !body.headers.every((h) => h && typeof h === 'object' && typeof (h as Record<string, unknown>).key === 'string' && typeof (h as Record<string, unknown>).value === 'string')) {
+    return { ok: false, error: 'headers must be an array of {key, value} strings' }
+  }
+  if (body.responseJsonPath !== undefined && typeof body.responseJsonPath !== 'string') {
+    return { ok: false, error: 'responseJsonPath must be a string' }
+  }
+  if (body.decision !== undefined && !isDecision(body.decision)) {
+    return { ok: false, error: 'decision must be allow, ask, or deny' }
+  }
+
+  return {
+    ok: true,
+    value: {
+      name: body.name,
+      description: body.description,
+      fields: fields as unknown as HttpToolSpec['fields'],
+      method,
+      url: body.url,
+      headers: body.headers as HttpToolSpec['headers'],
+      sendFieldsAsJsonBody: body.sendFieldsAsJsonBody === true,
+      responseJsonPath: body.responseJsonPath as string | undefined,
+    },
+    decision: body.decision as Decision | undefined,
+  }
+}
+
+// Backs the Tools tab's "Create an HTTP tool" form — generates a real
+// agents/:name/tools/<tool>.ts file (loopengine's own createHttpTool),
+// then splices the freshly-imported ToolDefinition straight into this
+// process's own live registry via updateAgent (../agent-registry.js) —
+// the same "no restart needed" mechanism a newly-created agent already
+// gets (see registerAgent's own doc comment), and deliberately not a
+// reliance on tsx watch picking up the new file: this way the tool is
+// callable immediately under `serve` (no watch) too, not just `dev`. An
+// optional `decision` seeds one actauth.yml rule via the already-existing
+// addActauthRule, mirroring gateway-tools.ts's own "a rule is opt-in,
+// omitting it falls through to default_decision" precedent — never a
+// hardcoded default here.
+async function handleHttpToolPost(req: IncomingMessage, res: ServerResponse, agentName: string): Promise<void> {
+  const entry = getEntry(agentName)
+  if (!entry) {
+    res.writeHead(404, { 'content-type': 'application/json' }).end(JSON.stringify({ error: `unknown agent '${agentName}'` }))
+    return
+  }
+  const body = await readJsonBody(req)
+  const parsed = parseHttpToolBody(body)
+  if (!parsed.ok) {
+    res.writeHead(400, { 'content-type': 'application/json' }).end(JSON.stringify({ error: parsed.error }))
+    return
+  }
+
+  let tool: ToolDefinition
+  try {
+    const result = await createHttpTool(agentName, parsed.value)
+    tool = result.tool
+  } catch (err) {
+    const status = err instanceof HttpToolExistsError ? 409 : err instanceof HttpToolNameError || err instanceof HttpToolIndexShapeError ? 400 : 500
+    res.writeHead(status, { 'content-type': 'application/json' }).end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }))
+    return
+  }
+
+  const currentTools = entry.config.tools ?? (await loadDefaultTools(entry.config))
+  updateAgent(agentName, { config: { tools: [...currentTools, tool] } })
+
+  if (parsed.decision) {
+    try {
+      addActauthRule(agentName, { name: `${parsed.value.name}-admin-created`, scope: '*/*', tool: parsed.value.name, decision: parsed.decision })
+    } catch (err) {
+      // The tool file and live registration above already succeeded —
+      // a rule-seeding failure (near-impossible: only real cause is a
+      // same-named rule already existing) shouldn't roll either back,
+      // just surface as a warning-shaped success so the operator can
+      // add the rule by hand via the Actauth tab instead.
+      res.writeHead(200, { 'content-type': 'application/json' }).end(
+        JSON.stringify({ tool: describeTool(tool), ruleWarning: err instanceof Error ? err.message : String(err) }),
+      )
+      return
+    }
+  }
+
+  res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ tool: describeTool(tool) }))
+}
+
 // Backs GET /composio/connections and GET /composio/tools — not scoped
 // under /agents/:name/ like the routes above, deliberately: which apps
 // are connected and what they offer isn't a property of any one agent,
@@ -539,6 +654,33 @@ function parseAgentTemplateOptions(body: Record<string, unknown>): { ok: true; v
   return { ok: true, value: options }
 }
 
+// The Overview tab's "Limits & budgets" edit form — kept separate from
+// parseAgentTemplateOptions since that one's shape (AgentTemplateOptions)
+// is shared with handleCreateAgent/scaffoldAgent, which has no notion of
+// these three at all (a freshly scaffolded agent always starts on
+// loopengine's own defaults — see AgentConfig's own doc comments). Each
+// of the three is optional and independent, same as systemPrompt/model
+// above.
+function parsePositiveInt(value: unknown, field: string): { ok: true; value: number | undefined } | { ok: false; error: string } {
+  if (value === undefined || value === null) return { ok: true, value: undefined }
+  if (typeof value !== 'number' || !Number.isInteger(value) || value < 1) {
+    return { ok: false, error: `${field} must be a positive integer` }
+  }
+  return { ok: true, value }
+}
+
+function parseAgentLimitsFields(
+  body: Record<string, unknown>,
+): { ok: true; value: Pick<AgentEditableFields, 'maxTurns' | 'contextBudgetTokens' | 'skillIndexBudgetTokens'> } | { ok: false; error: string } {
+  const value: Pick<AgentEditableFields, 'maxTurns' | 'contextBudgetTokens' | 'skillIndexBudgetTokens'> = {}
+  for (const field of ['maxTurns', 'contextBudgetTokens', 'skillIndexBudgetTokens'] as const) {
+    const parsed = parsePositiveInt(body[field], field)
+    if (!parsed.ok) return parsed
+    if (parsed.value !== undefined) value[field] = parsed.value
+  }
+  return { ok: true, value }
+}
+
 async function handleCreateAgent(req: IncomingMessage, res: ServerResponse): Promise<void> {
   const body = await readJsonBody(req)
   if (typeof body.name !== 'string' || !body.name) {
@@ -572,9 +714,11 @@ async function handleCreateAgent(req: IncomingMessage, res: ServerResponse): Pro
   res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ path: indexPath, registered: true }))
 }
 
-// Backs the Overview tab's System prompt / Model edit forms — either
-// field can be sent independently (see parseAgentTemplateOptions), the
-// other stays untouched both on disk and live. Persists via
+// Backs the Overview tab's System prompt / Model / Limits & budgets edit
+// forms — any subset of systemPrompt, model, maxTurns, contextBudgetTokens,
+// skillIndexBudgetTokens can be sent independently (see
+// parseAgentTemplateOptions/parseAgentLimitsFields), every other field
+// stays untouched both on disk and live. Persists via
 // agent-file-admin.ts's editAgentFile (see its own doc comment for why
 // this is a surgical AST edit, not a full file regeneration), then
 // applies the exact same resolved values to *this* running process via
@@ -594,14 +738,22 @@ async function handleEditAgent(req: IncomingMessage, res: ServerResponse, agentN
     res.writeHead(400, { 'content-type': 'application/json' }).end(JSON.stringify({ error: parsedOptions.error }))
     return
   }
-  if (parsedOptions.value.systemPrompt === undefined && parsedOptions.value.model === undefined) {
-    res.writeHead(400, { 'content-type': 'application/json' }).end(JSON.stringify({ error: 'systemPrompt or model is required' }))
+  const parsedLimits = parseAgentLimitsFields(body)
+  if (!parsedLimits.ok) {
+    res.writeHead(400, { 'content-type': 'application/json' }).end(JSON.stringify({ error: parsedLimits.error }))
+    return
+  }
+  const editFields: AgentEditableFields = { ...parsedOptions.value, ...parsedLimits.value }
+  if (Object.keys(editFields).length === 0) {
+    res
+      .writeHead(400, { 'content-type': 'application/json' })
+      .end(JSON.stringify({ error: 'systemPrompt, model, maxTurns, contextBudgetTokens, or skillIndexBudgetTokens is required' }))
     return
   }
 
   let result: AgentEditResult
   try {
-    result = editAgentFile(agentName, parsedOptions.value)
+    result = editAgentFile(agentName, editFields)
   } catch (err) {
     const status =
       err instanceof AgentEditNotSupportedError || err instanceof AgentModelError ? 400 : err instanceof AgentFileNotFoundError ? 404 : 500
@@ -611,6 +763,9 @@ async function handleEditAgent(req: IncomingMessage, res: ServerResponse, agentN
 
   const configPatch: Partial<AgentConfig> = {}
   if (result.systemPrompt !== undefined) configPatch.systemPrompt = result.systemPrompt
+  if (result.maxTurns !== undefined) configPatch.maxTurns = result.maxTurns
+  if (result.contextBudgetTokens !== undefined) configPatch.contextBudgetTokens = result.contextBudgetTokens
+  if (result.skillIndexBudgetTokens !== undefined) configPatch.skillIndexBudgetTokens = result.skillIndexBudgetTokens
   let createModelCall: RegistryEntry['createModelCall'] | undefined
   if (result.model) {
     configPatch.model = result.model
@@ -677,6 +832,69 @@ function handleSkillDelete(res: ServerResponse, agentName: string, skillId: stri
   res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ ok: true }))
 }
 
+// Backs the Skills tab's "Browse skillgarden catalog" section — a
+// read-only, agent-independent list of everything skillgarden ships in
+// its own bundled registry (see loopengine's own web/skillgarden-admin.ts).
+// Not wrapped in a per-agent :name segment since the catalog itself
+// isn't scoped to any one agent; only the POST below (actually
+// installing an entry) is.
+function handleSkillgardenCatalogGet(res: ServerResponse): void {
+  try {
+    // Computed before writeHead, not inlined into .end()'s own argument —
+    // res.writeHead(200, ...) commits the status line the instant it's
+    // called, so a throw evaluated *after* it (as it would be if it were
+    // inlined as .end()'s argument) leaves headers already sent as 200
+    // with no body, and the catch block's own writeHead(status, ...)
+    // then fails outright (ERR_HTTP_HEADERS_SENT) instead of ever
+    // reaching the client.
+    const catalog = listSkillgardenCatalog()
+    res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify(catalog))
+  } catch (err) {
+    const status = err instanceof SkillgardenUnavailableError ? 503 : 500
+    res.writeHead(status, { 'content-type': 'application/json' }).end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }))
+  }
+}
+
+// Full SKILL.md body for the catalog's own "View" toggle — kept as a
+// separate route from the list above (rather than inlining every body
+// into it) for the same reason the Skills tab's own edit form fetches a
+// skill's body lazily instead of shipping it in the initial list.
+function handleSkillgardenCatalogEntryGet(res: ServerResponse, category: string, id: string): void {
+  try {
+    // See handleSkillgardenCatalogGet's own comment for why this is
+    // computed before writeHead rather than inlined into .end()'s
+    // argument.
+    const entry = readSkillgardenCatalogEntry(category, id)
+    res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify(entry))
+  } catch (err) {
+    const status = err instanceof SkillgardenUnavailableError ? 503 : 404
+    res.writeHead(status, { 'content-type': 'application/json' }).end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }))
+  }
+}
+
+// Installs a catalog entry into agents/:name/skills/ — delegates to
+// skillgarden's own addSkill (see skillgarden-admin.ts), which throws
+// plain Errors (no typed classes) for "unknown skill"/"already exists",
+// so those two are told apart by message shape rather than instanceof,
+// same as any other dependency that doesn't export typed errors for its
+// own failure modes.
+async function handleSkillgardenCatalogAdd(req: IncomingMessage, res: ServerResponse, agentName: string, category: string, id: string): Promise<void> {
+  if (!getEntry(agentName)) {
+    res.writeHead(404, { 'content-type': 'application/json' }).end(JSON.stringify({ error: `unknown agent '${agentName}'` }))
+    return
+  }
+  const body = await readJsonBody(req)
+  const force = body.force === true
+  try {
+    const result = addSkillgardenSkillToAgent(agentName, category, id, force)
+    res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ ok: true, id: result.id }))
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err)
+    const status = err instanceof SkillgardenUnavailableError ? 503 : /already exists/.test(message) ? 409 : /^Unknown skill/.test(message) ? 404 : 500
+    res.writeHead(status, { 'content-type': 'application/json' }).end(JSON.stringify({ error: message }))
+  }
+}
+
 // Backs the Actauth tab's rule editor — parses a rule body shared by both
 // the add (POST) and update (PUT, minus `name`) routes below.
 function parseActauthRuleBody(body: Record<string, unknown>, requireName: boolean): { ok: true; value: { name: string; scope: string; tool: string; decision: Decision } } | { ok: false; error: string } {
@@ -1779,6 +1997,12 @@ const server = createServer(async (req, res) => {
       return
     }
 
+    const httpToolMatch = req.method === 'POST' && pathname.match(/^\/agents\/([^/]+)\/tools\/http$/)
+    if (httpToolMatch) {
+      await handleHttpToolPost(req, res, decodeURIComponent(httpToolMatch[1]))
+      return
+    }
+
     // Backs the Skills tab's edit form — see skills-admin.ts for why
     // :skillId is restricted to a flat (non-nested) id.
     const skillMatch = pathname.match(/^\/agents\/([^/]+)\/skills\/([^/]+)$/)
@@ -1795,6 +2019,23 @@ const server = createServer(async (req, res) => {
       return
     }
 
+    // Backs the Skills tab's "Browse skillgarden catalog" section — see
+    // the three handlers above it.
+    if (req.method === 'GET' && pathname === '/skillgarden-catalog') {
+      handleSkillgardenCatalogGet(res)
+      return
+    }
+    const skillgardenEntryMatch = req.method === 'GET' && pathname.match(/^\/skillgarden-catalog\/([^/]+)\/([^/]+)$/)
+    if (skillgardenEntryMatch) {
+      handleSkillgardenCatalogEntryGet(res, decodeURIComponent(skillgardenEntryMatch[1]), decodeURIComponent(skillgardenEntryMatch[2]))
+      return
+    }
+    const skillgardenAddMatch = req.method === 'POST' && pathname.match(/^\/agents\/([^/]+)\/skillgarden-catalog\/([^/]+)\/([^/]+)$/)
+    if (skillgardenAddMatch) {
+      await handleSkillgardenCatalogAdd(req, res, decodeURIComponent(skillgardenAddMatch[1]), decodeURIComponent(skillgardenAddMatch[2]), decodeURIComponent(skillgardenAddMatch[3]))
+      return
+    }
+
     // Backs the Actauth tab's rule editor and default_decision control.
     // The default-decision route is checked before the :ruleName routes
     // right below since 'default-decision' would otherwise itself match

package/template/package.json

@@ -9,9 +9,9 @@
     "cli": "tsx adapters/cli.ts"
   },
   "dependencies": {
-    "loopengine": "^0.1.4",
+    "loopengine": "^0.1.6",
     "actauth": "^0.0.12",
-    "skillgarden": "^0.0.5"
+    "skillgarden": "^0.0.9"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",