create-loopengine 0.1.36 → 0.1.38

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-loopengine",
-  "version": "0.1.36",
+  "version": "0.1.38",
   "description": "Scaffold a new loopengine agent project — a runnable HTTP server with one example agent, in your own repo.",
   "license": "MIT",
   "type": "module",

package/template/adapters/http.ts

@@ -27,9 +27,13 @@
 // *same* session don't race on read-modify-write of that session's
 // history. What counts as "the same session" is deliberately not this
 // file's call — see AgentConfig.sessionIdFor and defaultSessionIdFor below.
+import { execFile } from 'node:child_process'
 import { randomUUID, timingSafeEqual } from 'node:crypto'
+import { existsSync } from 'node:fs'
 import { createServer, type IncomingMessage, type ServerResponse } from 'node:http'
+import { join } from 'node:path'
 import { pathToFileURL } from 'node:url'
+import { promisify } from 'node:util'
 import { getEntry, listAgents, projectDir, registerAgent, updateAgent, type RegistryEntry } from '../agent-registry.js'
 import {
   loadAgentModule,
@@ -104,6 +108,7 @@ import {
   AbilityVersionError,
   AbilityNotInstalledError,
   searchPublicAbilities,
+  fetchLatestAbilityVersion,
   describeModelProviders,
   describeGateways,
   scaffoldAgent,
@@ -998,15 +1003,42 @@ async function handleEnvPut(req: IncomingMessage, res: ServerResponse, agentName
   res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ ok: true }))
 }
 
+// A cheap, good-enough presence check — existsSync(node_modules/<dep>)
+// — rather than an actual module resolution (require.resolve/
+// import.meta.resolve): this only ever decides whether to show an
+// "Install deps" button, not whether the ability will actually work, so
+// a false negative in an unusual node_modules layout (a workspace
+// hoisting a dep up to a parent directory this project doesn't own,
+// say) just means the button stays visible a little too long — an
+// extra no-op npm install away from being right again — not a wrong
+// answer the operator has to debug.
+function hasNodeModule(name: string): boolean {
+  return existsSync(join(process.cwd(), 'node_modules', name))
+}
+
 // Backs the Admin UI's Abilities tab list — everything currently
-// installed for this agent. Read-only, so no extra auth gate beyond the
-// normal Basic Auth middleware every admin route already has.
-function handleAbilitiesGet(res: ServerResponse, agentName: string): void {
+// installed for this agent, each annotated with the latest version
+// currently published on the public npm registry (fetchLatestAbilityVersion,
+// best-effort — null for a private/file:/git-installed ability, or on any
+// registry hiccup) so the tab can skip offering an "Upgrade" button for
+// something already at the newest version, and with `missingDependencies`
+// (see hasNodeModule) so it can likewise skip offering "Install deps"
+// once they're all already present. Read-only, so no extra auth gate
+// beyond the normal Basic Auth middleware every admin route already has.
+async function handleAbilitiesGet(res: ServerResponse, agentName: string): Promise<void> {
   if (!getEntry(agentName)) {
     res.writeHead(404, { 'content-type': 'application/json' }).end(JSON.stringify({ error: `unknown agent '${agentName}'` }))
     return
   }
-  res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ abilities: listInstalledAbilities(agentName) }))
+  const installed = listInstalledAbilities(agentName)
+  const abilities = await Promise.all(
+    installed.map(async (a) => {
+      const latestVersion = await fetchLatestAbilityVersion(a.name)
+      const missingDependencies = (a.dependencies ?? []).filter((dep) => !hasNodeModule(dep))
+      return { ...a, latestVersion, upToDate: latestVersion !== null && latestVersion === a.version, missingDependencies }
+    }),
+  )
+  res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ abilities }))
 }
 
 // Backs the Abilities tab's search box — proxies to npm's own public
@@ -1099,6 +1131,60 @@ async function handleAbilityUpgradePost(req: IncomingMessage, res: ServerRespons
   }
 }
 
+const execFileAsync = promisify(execFile)
+const NPM_INSTALL_DEPS_TIMEOUT_MS = 180_000
+
+// Runs npm install <deps> in the project's own root (process.cwd(),
+// same convention loopengine's own env-admin.ts already establishes) —
+// the real npm packages an installed ability's tool code imports (e.g.
+// sharp, jszip) that installAbility itself never touches (it only ever
+// copies the ability's own files, deliberately never package.json/
+// node_modules — see installAbility's own doc comment). Meaningfully
+// more consequential than installing an ability's files: this mutates
+// the whole project's package.json/lockfile and runs arbitrary npm
+// lifecycle scripts, so same refuse-outright-without-
+// LOOPENGINE_ADMIN_AUTH posture as installing/upgrading an ability
+// itself. `deps` is read back off this ability's own persisted
+// provenance record (InstalledAbilityRecord.dependencies), never taken
+// from the request body — accepting an arbitrary client-supplied package
+// list here would let anyone who can reach this route install anything
+// on the server, not just what an already-installed ability actually
+// declared. execFile (array argv, no shell) rather than exec/a template
+// string — a dependency name is whatever text an ability's own
+// package.json happened to declare, not something to trust for shell
+// interpolation.
+async function handleAbilityInstallDepsPost(req: IncomingMessage, res: ServerResponse, agentName: string, abilityName: string): Promise<void> {
+  if (!adminAuth) {
+    res.writeHead(403, { 'content-type': 'application/json' }).end(
+      JSON.stringify({ error: 'Refusing to run npm install without LOOPENGINE_ADMIN_AUTH configured — set it before installing dependencies through this route.' }),
+    )
+    return
+  }
+  if (!getEntry(agentName)) {
+    res.writeHead(404, { 'content-type': 'application/json' }).end(JSON.stringify({ error: `unknown agent '${agentName}'` }))
+    return
+  }
+  const record = listInstalledAbilities(agentName).find((a) => a.name === abilityName)
+  if (!record) {
+    res.writeHead(404, { 'content-type': 'application/json' }).end(JSON.stringify({ error: `Ability '${abilityName}' isn't installed for '${agentName}'.` }))
+    return
+  }
+  const deps = record.dependencies ?? []
+  if (!deps.length) {
+    res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ installed: [] }))
+    return
+  }
+  try {
+    await execFileAsync('npm', ['install', ...deps], { cwd: process.cwd(), timeout: NPM_INSTALL_DEPS_TIMEOUT_MS })
+    res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ installed: deps }))
+  } catch (err) {
+    const stderr = err && typeof err === 'object' && 'stderr' in err ? String((err as { stderr: unknown }).stderr) : undefined
+    res.writeHead(500, { 'content-type': 'application/json' }).end(
+      JSON.stringify({ error: stderr || (err instanceof Error ? err.message : String(err)) }),
+    )
+  }
+}
+
 // Backs the Actauth tab's rule editor — parses a rule body shared by both
 // the add (POST) and update (PUT, minus `name`) routes below.
 function parseActauthRuleBody(body: Record<string, unknown>, requireName: boolean): { ok: true; value: { name: string; scope: string; tool: string; decision: Decision } } | { ok: false; error: string } {
@@ -2282,9 +2368,14 @@ const server = createServer(async (req, res) => {
       await handleAbilityUpgradePost(req, res, decodeURIComponent(abilityUpgradeMatch[1]), decodeURIComponent(abilityUpgradeMatch[2]))
       return
     }
+    const abilityInstallDepsMatch = pathname.match(/^\/agents\/([^/]+)\/abilities\/([^/]+)\/install-deps$/)
+    if (abilityInstallDepsMatch && req.method === 'POST') {
+      await handleAbilityInstallDepsPost(req, res, decodeURIComponent(abilityInstallDepsMatch[1]), decodeURIComponent(abilityInstallDepsMatch[2]))
+      return
+    }
     const abilitiesMatch = pathname.match(/^\/agents\/([^/]+)\/abilities$/)
     if (abilitiesMatch && req.method === 'GET') {
-      handleAbilitiesGet(res, decodeURIComponent(abilitiesMatch[1]))
+      await handleAbilitiesGet(res, decodeURIComponent(abilitiesMatch[1]))
       return
     }
     if (abilitiesMatch && req.method === 'POST') {