create-loopengine 0.1.31 → 0.1.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-loopengine",
-  "version": "0.1.31",
+  "version": "0.1.33",
   "description": "Scaffold a new loopengine agent project — a runnable HTTP server with one example agent, in your own repo.",
   "license": "MIT",
   "type": "module",

package/template/adapters/http.ts

@@ -95,6 +95,13 @@ import {
   setDefaultDecision,
   ActauthRuleExistsError,
   ActauthRuleNotFoundError,
+  installAbility,
+  listInstalledAbilities,
+  AbilityAlreadyInstalledError,
+  AbilityCollisionError,
+  AbilityManifestError,
+  AbilityVersionError,
+  searchPublicAbilities,
   describeModelProviders,
   describeGateways,
   scaffoldAgent,
@@ -920,8 +927,8 @@ function handleSkillDelete(res: ServerResponse, agentName: string, skillId: stri
   res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ ok: true }))
 }
 
-// Backs the Admin UI's "Environment" section — every env var a package
-// (see loopengine's own PACKAGES.md, bin/package-manager.ts) declared it
+// Backs the Admin UI's "Environment" section — every env var an ability
+// (see loopengine's own ABILITIES.md, bin/ability-manager.ts) declared it
 // needs for this agent, with set/not-set status only. Read-only, so no
 // extra auth gate beyond the normal Basic Auth middleware every admin
 // route already has.
@@ -938,7 +945,7 @@ function handleEnvGet(res: ServerResponse, agentName: string): void {
 // credential), so unlike every other route here, this one refuses
 // outright when LOOPENGINE_ADMIN_AUTH isn't set at all, rather than just
 // warning at startup and proceeding open like the rest of this file does
-// (see loopengine's own PACKAGES.md, "Managing package secrets in the
+// (see loopengine's own ABILITIES.md, "Managing ability secrets in the
 // Admin UI" — LOOPENGINE_ADMIN_AUTH being optional today is an
 // acceptable gap for config, not for secrets).
 async function handleEnvPut(req: IncomingMessage, res: ServerResponse, agentName: string, varName: string): Promise<void> {
@@ -967,6 +974,75 @@ async function handleEnvPut(req: IncomingMessage, res: ServerResponse, agentName
   res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ ok: true }))
 }
 
+// Backs the Admin UI's Abilities tab list — everything currently
+// installed for this agent. Read-only, so no extra auth gate beyond the
+// normal Basic Auth middleware every admin route already has.
+function handleAbilitiesGet(res: ServerResponse, agentName: string): void {
+  if (!getEntry(agentName)) {
+    res.writeHead(404, { 'content-type': 'application/json' }).end(JSON.stringify({ error: `unknown agent '${agentName}'` }))
+    return
+  }
+  res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ abilities: listInstalledAbilities(agentName) }))
+}
+
+// Backs the Abilities tab's search box — proxies to npm's own public
+// registry search (loopengine's own searchPublicAbilities) so the
+// browser never needs direct access to registry.npmjs.org, and the
+// actual query text (the loopengine-ability keyword filter) stays a
+// server-side detail rather than something the client has to know to
+// construct.
+async function handleAbilitiesSearchGet(res: ServerResponse, agentName: string, query: string | null): Promise<void> {
+  if (!getEntry(agentName)) {
+    res.writeHead(404, { 'content-type': 'application/json' }).end(JSON.stringify({ error: `unknown agent '${agentName}'` }))
+    return
+  }
+  try {
+    const results = await searchPublicAbilities(query ?? undefined)
+    res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ results }))
+  } catch (err) {
+    res.writeHead(502, { 'content-type': 'application/json' }).end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }))
+  }
+}
+
+// Installs an ability — any spec `npm pack` accepts (a bare/scoped
+// registry name, a pinned version, a git URL, or a local `file:../path`
+// for a private ability) — into this agent's own tree. Meaningfully
+// more sensitive than the rest of this admin surface: this runs
+// arbitrary third-party code inside the agent's project the next time
+// it's loaded, not just a config value or a credential. Same posture as
+// handleEnvPut's own secret-writing gate above — refuses outright when
+// LOOPENGINE_ADMIN_AUTH isn't configured at all, rather than proceeding
+// open like most routes here do.
+async function handleAbilityInstallPost(req: IncomingMessage, res: ServerResponse, agentName: string): Promise<void> {
+  if (!adminAuth) {
+    res.writeHead(403, { 'content-type': 'application/json' }).end(
+      JSON.stringify({ error: 'Refusing to install an ability without LOOPENGINE_ADMIN_AUTH configured — set it before installing abilities through this route.' }),
+    )
+    return
+  }
+  if (!getEntry(agentName)) {
+    res.writeHead(404, { 'content-type': 'application/json' }).end(JSON.stringify({ error: `unknown agent '${agentName}'` }))
+    return
+  }
+  const body = await readJsonBody(req)
+  if (typeof body.spec !== 'string' || !body.spec) {
+    res.writeHead(400, { 'content-type': 'application/json' }).end(JSON.stringify({ error: 'spec is required' }))
+    return
+  }
+  try {
+    const result = await installAbility(agentName, body.spec)
+    res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify(result))
+  } catch (err) {
+    const status =
+      err instanceof AbilityAlreadyInstalledError || err instanceof AbilityCollisionError
+        ? 409
+        : err instanceof AbilityManifestError || err instanceof AbilityVersionError
+          ? 422
+          : 500
+    res.writeHead(status, { 'content-type': 'application/json' }).end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }))
+  }
+}
+
 // Backs the Actauth tab's rule editor — parses a rule body shared by both
 // the add (POST) and update (PUT, minus `name`) routes below.
 function parseActauthRuleBody(body: Record<string, unknown>, requireName: boolean): { ok: true; value: { name: string; scope: string; tool: string; decision: Decision } } | { ok: false; error: string } {
@@ -2116,6 +2192,29 @@ const server = createServer(async (req, res) => {
       return
     }
 
+    // Backs the Admin UI's Abilities tab — see handleAbilitiesGet/
+    // handleAbilitiesSearchGet/handleAbilityInstallPost's own doc
+    // comments above. The /search route is checked before the plain
+    // :agentName routes right below since 'search' would otherwise
+    // itself need to be excluded from matching as an agent name (it
+    // never would be one in practice, but this ordering means never
+    // having to think about it).
+    const abilitiesSearchMatch = pathname.match(/^\/agents\/([^/]+)\/abilities\/search$/)
+    if (abilitiesSearchMatch && req.method === 'GET') {
+      const query = new URL(req.url ?? '/', 'http://localhost').searchParams.get('q')
+      await handleAbilitiesSearchGet(res, decodeURIComponent(abilitiesSearchMatch[1]), query)
+      return
+    }
+    const abilitiesMatch = pathname.match(/^\/agents\/([^/]+)\/abilities$/)
+    if (abilitiesMatch && req.method === 'GET') {
+      handleAbilitiesGet(res, decodeURIComponent(abilitiesMatch[1]))
+      return
+    }
+    if (abilitiesMatch && req.method === 'POST') {
+      await handleAbilityInstallPost(req, res, decodeURIComponent(abilitiesMatch[1]))
+      return
+    }
+
     // Backs the Actauth tab's rule editor and default_decision control.
     // The default-decision route is checked before the :ruleName routes
     // right below since 'default-decision' would otherwise itself match