create-loopengine 0.1.34 → 0.1.36

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-loopengine",
-  "version": "0.1.34",
+  "version": "0.1.36",
   "description": "Scaffold a new loopengine agent project — a runnable HTTP server with one example agent, in your own repo.",
   "license": "MIT",
   "type": "module",

package/template/adapters/http.ts

@@ -96,11 +96,13 @@ import {
   ActauthRuleExistsError,
   ActauthRuleNotFoundError,
   installAbility,
+  upgradeAbility,
   listInstalledAbilities,
   AbilityAlreadyInstalledError,
   AbilityCollisionError,
   AbilityManifestError,
   AbilityVersionError,
+  AbilityNotInstalledError,
   searchPublicAbilities,
   describeModelProviders,
   describeGateways,
@@ -975,6 +977,17 @@ async function handleEnvPut(req: IncomingMessage, res: ServerResponse, agentName
     res.writeHead(400, { 'content-type': 'application/json' }).end(JSON.stringify({ error: 'value is required' }))
     return
   }
+  // A dropdown-backed var (AbilityEnvDecl.options) is still writable
+  // through this same raw route — worth rejecting an out-of-set value
+  // here too, not just skipping validation because the Admin UI's own
+  // <select> would never have produced one.
+  const declared = listDeclaredEnvVars(agentName).find((v) => v.name === varName)
+  if (declared?.options && !declared.options.includes(body.value)) {
+    res.writeHead(400, { 'content-type': 'application/json' }).end(
+      JSON.stringify({ error: `"${body.value}" isn't one of this var's allowed values: ${declared.options.join(', ')}` }),
+    )
+    return
+  }
   try {
     setEnvVar(varName, body.value)
   } catch (err) {
@@ -1054,6 +1067,38 @@ async function handleAbilityInstallPost(req: IncomingMessage, res: ServerRespons
   }
 }
 
+// Upgrades an already-installed ability to whatever it currently
+// resolves to (or, optionally, a specific spec) — same admin-auth
+// posture as handleAbilityInstallPost above, since this runs arbitrary
+// third-party code inside the agent's project the next time it's
+// loaded, same as install does.
+async function handleAbilityUpgradePost(req: IncomingMessage, res: ServerResponse, agentName: string, abilityName: string): Promise<void> {
+  if (!adminAuth) {
+    res.writeHead(403, { 'content-type': 'application/json' }).end(
+      JSON.stringify({ error: 'Refusing to upgrade an ability without LOOPENGINE_ADMIN_AUTH configured — set it before upgrading abilities through this route.' }),
+    )
+    return
+  }
+  if (!getEntry(agentName)) {
+    res.writeHead(404, { 'content-type': 'application/json' }).end(JSON.stringify({ error: `unknown agent '${agentName}'` }))
+    return
+  }
+  const body = await readJsonBody(req)
+  const spec = typeof body.spec === 'string' && body.spec ? body.spec : undefined
+  try {
+    const result = await upgradeAbility(agentName, abilityName, spec ? { spec } : {})
+    res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify(result))
+  } catch (err) {
+    const status =
+      err instanceof AbilityNotInstalledError
+        ? 404
+        : err instanceof AbilityManifestError || err instanceof AbilityVersionError
+          ? 422
+          : 500
+    res.writeHead(status, { 'content-type': 'application/json' }).end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }))
+  }
+}
+
 // Backs the Actauth tab's rule editor — parses a rule body shared by both
 // the add (POST) and update (PUT, minus `name`) routes below.
 function parseActauthRuleBody(body: Record<string, unknown>, requireName: boolean): { ok: true; value: { name: string; scope: string; tool: string; decision: Decision } } | { ok: false; error: string } {
@@ -2232,6 +2277,11 @@ const server = createServer(async (req, res) => {
       await handleAbilitiesSearchGet(res, decodeURIComponent(abilitiesSearchMatch[1]), query)
       return
     }
+    const abilityUpgradeMatch = pathname.match(/^\/agents\/([^/]+)\/abilities\/([^/]+)\/upgrade$/)
+    if (abilityUpgradeMatch && req.method === 'POST') {
+      await handleAbilityUpgradePost(req, res, decodeURIComponent(abilityUpgradeMatch[1]), decodeURIComponent(abilityUpgradeMatch[2]))
+      return
+    }
     const abilitiesMatch = pathname.match(/^\/agents\/([^/]+)\/abilities$/)
     if (abilitiesMatch && req.method === 'GET') {
       handleAbilitiesGet(res, decodeURIComponent(abilitiesMatch[1]))