create-loopengine 0.1.33 → 0.1.35

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-loopengine",
-  "version": "0.1.33",
+  "version": "0.1.35",
   "description": "Scaffold a new loopengine agent project — a runnable HTTP server with one example agent, in your own repo.",
   "license": "MIT",
   "type": "module",

package/template/adapters/http.ts

@@ -868,7 +868,18 @@ async function handleEditAgent(req: IncomingMessage, res: ServerResponse, agentN
   }
   updateAgent(agentName, { config: configPatch, createModelCall })
 
-  res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify(await describeAgent(getEntry(agentName)!)))
+  // Same "compute before writeHead" reasoning as the GET .../config
+  // route above — describeAgent can throw (a broken tools/index.ts
+  // import), and chaining it straight into .end()'s argument would send
+  // a 200 status before finding that out.
+  let described: Record<string, unknown>
+  try {
+    described = await describeAgent(getEntry(agentName)!)
+  } catch (err) {
+    res.writeHead(500, { 'content-type': 'application/json' }).end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }))
+    return
+  }
+  res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify(described))
 }
 
 // Backs the Skills tab's edit form (GET .../skills/:skillId to populate
@@ -964,6 +975,17 @@ async function handleEnvPut(req: IncomingMessage, res: ServerResponse, agentName
     res.writeHead(400, { 'content-type': 'application/json' }).end(JSON.stringify({ error: 'value is required' }))
     return
   }
+  // A dropdown-backed var (AbilityEnvDecl.options) is still writable
+  // through this same raw route — worth rejecting an out-of-set value
+  // here too, not just skipping validation because the Admin UI's own
+  // <select> would never have produced one.
+  const declared = listDeclaredEnvVars(agentName).find((v) => v.name === varName)
+  if (declared?.options && !declared.options.includes(body.value)) {
+    res.writeHead(400, { 'content-type': 'application/json' }).end(
+      JSON.stringify({ error: `"${body.value}" isn't one of this var's allowed values: ${declared.options.join(', ')}` }),
+    )
+    return
+  }
   try {
     setEnvVar(varName, body.value)
   } catch (err) {
@@ -2087,7 +2109,23 @@ const server = createServer(async (req, res) => {
         res.writeHead(404, { 'content-type': 'application/json' }).end(JSON.stringify({ error: `unknown agent '${agentName}'` }))
         return
       }
-      res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify(await describeAgent(entry)))
+      // describeAgent dynamically imports this agent's own tools/index.ts
+      // (loadDefaultTools) — a broken import there (a bad tool file, a
+      // dependency the agent's own code needs but doesn't have) throws.
+      // Computed before writeHead, not chained directly into .end() as an
+      // argument — chaining would send the 200 status line first, then
+      // throw while still computing the body, leaving the connection
+      // open with headers sent but no body ever written (a client-side
+      // "Unexpected end of JSON input", not a clear error) instead of a
+      // real 500 with an actual message.
+      let described: Record<string, unknown>
+      try {
+        described = await describeAgent(entry)
+      } catch (err) {
+        res.writeHead(500, { 'content-type': 'application/json' }).end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }))
+        return
+      }
+      res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify(described))
       return
     }