create-loopengine 0.1.32 → 0.1.34

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-loopengine",
-  "version": "0.1.32",
+  "version": "0.1.34",
   "description": "Scaffold a new loopengine agent project — a runnable HTTP server with one example agent, in your own repo.",
   "license": "MIT",
   "type": "module",

package/template/adapters/http.ts

@@ -95,6 +95,13 @@ import {
   setDefaultDecision,
   ActauthRuleExistsError,
   ActauthRuleNotFoundError,
+  installAbility,
+  listInstalledAbilities,
+  AbilityAlreadyInstalledError,
+  AbilityCollisionError,
+  AbilityManifestError,
+  AbilityVersionError,
+  searchPublicAbilities,
   describeModelProviders,
   describeGateways,
   scaffoldAgent,
@@ -861,7 +868,18 @@ async function handleEditAgent(req: IncomingMessage, res: ServerResponse, agentN
   }
   updateAgent(agentName, { config: configPatch, createModelCall })
 
-  res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify(await describeAgent(getEntry(agentName)!)))
+  // Same "compute before writeHead" reasoning as the GET .../config
+  // route above — describeAgent can throw (a broken tools/index.ts
+  // import), and chaining it straight into .end()'s argument would send
+  // a 200 status before finding that out.
+  let described: Record<string, unknown>
+  try {
+    described = await describeAgent(getEntry(agentName)!)
+  } catch (err) {
+    res.writeHead(500, { 'content-type': 'application/json' }).end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }))
+    return
+  }
+  res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify(described))
 }
 
 // Backs the Skills tab's edit form (GET .../skills/:skillId to populate
@@ -967,6 +985,75 @@ async function handleEnvPut(req: IncomingMessage, res: ServerResponse, agentName
   res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ ok: true }))
 }
 
+// Backs the Admin UI's Abilities tab list — everything currently
+// installed for this agent. Read-only, so no extra auth gate beyond the
+// normal Basic Auth middleware every admin route already has.
+function handleAbilitiesGet(res: ServerResponse, agentName: string): void {
+  if (!getEntry(agentName)) {
+    res.writeHead(404, { 'content-type': 'application/json' }).end(JSON.stringify({ error: `unknown agent '${agentName}'` }))
+    return
+  }
+  res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ abilities: listInstalledAbilities(agentName) }))
+}
+
+// Backs the Abilities tab's search box — proxies to npm's own public
+// registry search (loopengine's own searchPublicAbilities) so the
+// browser never needs direct access to registry.npmjs.org, and the
+// actual query text (the loopengine-ability keyword filter) stays a
+// server-side detail rather than something the client has to know to
+// construct.
+async function handleAbilitiesSearchGet(res: ServerResponse, agentName: string, query: string | null): Promise<void> {
+  if (!getEntry(agentName)) {
+    res.writeHead(404, { 'content-type': 'application/json' }).end(JSON.stringify({ error: `unknown agent '${agentName}'` }))
+    return
+  }
+  try {
+    const results = await searchPublicAbilities(query ?? undefined)
+    res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ results }))
+  } catch (err) {
+    res.writeHead(502, { 'content-type': 'application/json' }).end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }))
+  }
+}
+
+// Installs an ability — any spec `npm pack` accepts (a bare/scoped
+// registry name, a pinned version, a git URL, or a local `file:../path`
+// for a private ability) — into this agent's own tree. Meaningfully
+// more sensitive than the rest of this admin surface: this runs
+// arbitrary third-party code inside the agent's project the next time
+// it's loaded, not just a config value or a credential. Same posture as
+// handleEnvPut's own secret-writing gate above — refuses outright when
+// LOOPENGINE_ADMIN_AUTH isn't configured at all, rather than proceeding
+// open like most routes here do.
+async function handleAbilityInstallPost(req: IncomingMessage, res: ServerResponse, agentName: string): Promise<void> {
+  if (!adminAuth) {
+    res.writeHead(403, { 'content-type': 'application/json' }).end(
+      JSON.stringify({ error: 'Refusing to install an ability without LOOPENGINE_ADMIN_AUTH configured — set it before installing abilities through this route.' }),
+    )
+    return
+  }
+  if (!getEntry(agentName)) {
+    res.writeHead(404, { 'content-type': 'application/json' }).end(JSON.stringify({ error: `unknown agent '${agentName}'` }))
+    return
+  }
+  const body = await readJsonBody(req)
+  if (typeof body.spec !== 'string' || !body.spec) {
+    res.writeHead(400, { 'content-type': 'application/json' }).end(JSON.stringify({ error: 'spec is required' }))
+    return
+  }
+  try {
+    const result = await installAbility(agentName, body.spec)
+    res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify(result))
+  } catch (err) {
+    const status =
+      err instanceof AbilityAlreadyInstalledError || err instanceof AbilityCollisionError
+        ? 409
+        : err instanceof AbilityManifestError || err instanceof AbilityVersionError
+          ? 422
+          : 500
+    res.writeHead(status, { 'content-type': 'application/json' }).end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }))
+  }
+}
+
 // Backs the Actauth tab's rule editor — parses a rule body shared by both
 // the add (POST) and update (PUT, minus `name`) routes below.
 function parseActauthRuleBody(body: Record<string, unknown>, requireName: boolean): { ok: true; value: { name: string; scope: string; tool: string; decision: Decision } } | { ok: false; error: string } {
@@ -2011,7 +2098,23 @@ const server = createServer(async (req, res) => {
         res.writeHead(404, { 'content-type': 'application/json' }).end(JSON.stringify({ error: `unknown agent '${agentName}'` }))
         return
       }
-      res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify(await describeAgent(entry)))
+      // describeAgent dynamically imports this agent's own tools/index.ts
+      // (loadDefaultTools) — a broken import there (a bad tool file, a
+      // dependency the agent's own code needs but doesn't have) throws.
+      // Computed before writeHead, not chained directly into .end() as an
+      // argument — chaining would send the 200 status line first, then
+      // throw while still computing the body, leaving the connection
+      // open with headers sent but no body ever written (a client-side
+      // "Unexpected end of JSON input", not a clear error) instead of a
+      // real 500 with an actual message.
+      let described: Record<string, unknown>
+      try {
+        described = await describeAgent(entry)
+      } catch (err) {
+        res.writeHead(500, { 'content-type': 'application/json' }).end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }))
+        return
+      }
+      res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify(described))
       return
     }
 
@@ -2116,6 +2219,29 @@ const server = createServer(async (req, res) => {
       return
     }
 
+    // Backs the Admin UI's Abilities tab — see handleAbilitiesGet/
+    // handleAbilitiesSearchGet/handleAbilityInstallPost's own doc
+    // comments above. The /search route is checked before the plain
+    // :agentName routes right below since 'search' would otherwise
+    // itself need to be excluded from matching as an agent name (it
+    // never would be one in practice, but this ordering means never
+    // having to think about it).
+    const abilitiesSearchMatch = pathname.match(/^\/agents\/([^/]+)\/abilities\/search$/)
+    if (abilitiesSearchMatch && req.method === 'GET') {
+      const query = new URL(req.url ?? '/', 'http://localhost').searchParams.get('q')
+      await handleAbilitiesSearchGet(res, decodeURIComponent(abilitiesSearchMatch[1]), query)
+      return
+    }
+    const abilitiesMatch = pathname.match(/^\/agents\/([^/]+)\/abilities$/)
+    if (abilitiesMatch && req.method === 'GET') {
+      handleAbilitiesGet(res, decodeURIComponent(abilitiesMatch[1]))
+      return
+    }
+    if (abilitiesMatch && req.method === 'POST') {
+      await handleAbilityInstallPost(req, res, decodeURIComponent(abilitiesMatch[1]))
+      return
+    }
+
     // Backs the Actauth tab's rule editor and default_decision control.
     // The default-decision route is checked before the :ruleName routes
     // right below since 'default-decision' would otherwise itself match