create-loopengine 0.1.20 → 0.1.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-loopengine",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "description": "Scaffold a new loopengine agent project — a runnable HTTP server with one example agent, in your own repo.",
   "license": "MIT",
   "type": "module",

package/template/adapters/http.ts

@@ -85,6 +85,9 @@ import {
   deleteSkill,
   SkillInvalidIdError,
   SkillNotFoundError,
+  listDeclaredEnvVars,
+  setEnvVar,
+  EnvVarNameError,
   listSkillgardenCatalog,
   readSkillgardenCatalogEntry,
   addSkillgardenSkillToAgent,
@@ -503,6 +506,7 @@ function parseHttpToolBody(body: Record<string, unknown>): { ok: true; value: Ht
       headers: body.headers as HttpToolSpec['headers'],
       sendFieldsAsJsonBody: body.sendFieldsAsJsonBody === true,
       responseJsonPath: body.responseJsonPath as string | undefined,
+      safe: body.safe === true,
     },
     decision: body.decision as Decision | undefined,
   }
@@ -920,6 +924,53 @@ function handleSkillDelete(res: ServerResponse, agentName: string, skillId: stri
   res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ ok: true }))
 }
 
+// Backs the Admin UI's "Environment" section — every env var a package
+// (see loopengine's own PACKAGES.md, bin/package-manager.ts) declared it
+// needs for this agent, with set/not-set status only. Read-only, so no
+// extra auth gate beyond the normal Basic Auth middleware every admin
+// route already has.
+function handleEnvGet(res: ServerResponse, agentName: string): void {
+  if (!getEntry(agentName)) {
+    res.writeHead(404, { 'content-type': 'application/json' }).end(JSON.stringify({ error: `unknown agent '${agentName}'` }))
+    return
+  }
+  res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify(listDeclaredEnvVars(agentName)))
+}
+
+// Writes a raw secret value into .env — meaningfully more sensitive than
+// the rest of the admin surface (config/business data vs. an actual
+// credential), so unlike every other route here, this one refuses
+// outright when LOOPENGINE_ADMIN_AUTH isn't set at all, rather than just
+// warning at startup and proceeding open like the rest of this file does
+// (see loopengine's own PACKAGES.md, "Managing package secrets in the
+// Admin UI" — LOOPENGINE_ADMIN_AUTH being optional today is an
+// acceptable gap for config, not for secrets).
+async function handleEnvPut(req: IncomingMessage, res: ServerResponse, agentName: string, varName: string): Promise<void> {
+  if (!adminAuth) {
+    res.writeHead(403, { 'content-type': 'application/json' }).end(
+      JSON.stringify({ error: 'Refusing to set an env var without LOOPENGINE_ADMIN_AUTH configured — set it before managing secrets through this route.' }),
+    )
+    return
+  }
+  if (!getEntry(agentName)) {
+    res.writeHead(404, { 'content-type': 'application/json' }).end(JSON.stringify({ error: `unknown agent '${agentName}'` }))
+    return
+  }
+  const body = await readJsonBody(req)
+  if (typeof body.value !== 'string') {
+    res.writeHead(400, { 'content-type': 'application/json' }).end(JSON.stringify({ error: 'value is required' }))
+    return
+  }
+  try {
+    setEnvVar(varName, body.value)
+  } catch (err) {
+    const status = err instanceof EnvVarNameError ? 400 : 500
+    res.writeHead(status, { 'content-type': 'application/json' }).end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }))
+    return
+  }
+  res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ ok: true }))
+}
+
 // Backs the Skills tab's "Browse skillgarden catalog" section — a
 // read-only, agent-independent list of everything skillgarden ships in
 // its own bundled registry (see loopengine's own web/skillgarden-admin.ts).
@@ -2119,6 +2170,19 @@ const server = createServer(async (req, res) => {
       return
     }
 
+    // Backs the Admin UI's "Environment" section — see
+    // handleEnvGet/handleEnvPut's own doc comments above.
+    const envListMatch = pathname.match(/^\/agents\/([^/]+)\/env$/)
+    if (envListMatch && req.method === 'GET') {
+      handleEnvGet(res, decodeURIComponent(envListMatch[1]))
+      return
+    }
+    const envVarMatch = pathname.match(/^\/agents\/([^/]+)\/env\/([^/]+)$/)
+    if (envVarMatch && req.method === 'PUT') {
+      await handleEnvPut(req, res, decodeURIComponent(envVarMatch[1]), decodeURIComponent(envVarMatch[2]))
+      return
+    }
+
     // Backs the Skills tab's "Browse skillgarden catalog" section — see
     // the three handlers above it.
     if (req.method === 'GET' && pathname === '/skillgarden-catalog') {

package/template/package.json

@@ -9,7 +9,7 @@
     "cli": "tsx adapters/cli.ts"
   },
   "dependencies": {
-    "loopengine": "^0.1.10",
+    "loopengine": "^0.1.11",
     "actauth": "^0.0.12",
     "skillgarden": "^0.0.9"
   },