create-loopengine 0.1.45 → 0.1.47

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-loopengine",
-  "version": "0.1.45",
+  "version": "0.1.47",
   "description": "Scaffold a new loopengine agent project — a runnable HTTP server with one example agent, in your own repo.",
   "license": "MIT",
   "type": "module",

package/template/adapters/http.ts

@@ -29,9 +29,10 @@
 // file's call — see AgentConfig.sessionIdFor and defaultSessionIdFor below.
 import { execFile } from 'node:child_process'
 import { randomUUID, timingSafeEqual } from 'node:crypto'
-import { existsSync } from 'node:fs'
+import { createReadStream, existsSync } from 'node:fs'
+import { stat } from 'node:fs/promises'
 import { createServer, type IncomingMessage, type ServerResponse } from 'node:http'
-import { join } from 'node:path'
+import { extname, join, resolve as resolvePath, sep } from 'node:path'
 import { pathToFileURL } from 'node:url'
 import { promisify } from 'node:util'
 import { getEntry, listAgents, projectDir, registerAgent, updateAgent, type RegistryEntry } from '../agent-registry.js'
@@ -92,6 +93,7 @@ import {
   SkillNotFoundError,
   listDeclaredEnvVars,
   setEnvVar,
+  unsetEnvVar,
   EnvVarNameError,
   readActauthConfig,
   addActauthRule,
@@ -1066,6 +1068,31 @@ async function handleEnvPut(req: IncomingMessage, res: ServerResponse, agentName
   res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ ok: true }))
 }
 
+// Same auth requirement as handleEnvPut above and the same reasoning —
+// removing a secret from .env is still a secrets-management action,
+// not just config, so this refuses outright rather than proceeding
+// open when LOOPENGINE_ADMIN_AUTH isn't configured at all.
+async function handleEnvDelete(res: ServerResponse, agentName: string, varName: string): Promise<void> {
+  if (!adminAuth) {
+    res.writeHead(403, { 'content-type': 'application/json' }).end(
+      JSON.stringify({ error: 'Refusing to unset an env var without LOOPENGINE_ADMIN_AUTH configured — set it before managing secrets through this route.' }),
+    )
+    return
+  }
+  if (!getEntry(agentName)) {
+    res.writeHead(404, { 'content-type': 'application/json' }).end(JSON.stringify({ error: `unknown agent '${agentName}'` }))
+    return
+  }
+  try {
+    unsetEnvVar(varName)
+  } catch (err) {
+    const status = err instanceof EnvVarNameError ? 400 : 500
+    res.writeHead(status, { 'content-type': 'application/json' }).end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }))
+    return
+  }
+  res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ ok: true }))
+}
+
 // A cheap, good-enough presence check — existsSync(node_modules/<dep>)
 // — rather than an actual module resolution (require.resolve/
 // import.meta.resolve): this only ever decides whether to show an
@@ -2109,6 +2136,86 @@ async function handleStorageRedirect(req: IncomingMessage, res: ServerResponse):
   }
 }
 
+const LOCAL_FILE_CONTENT_TYPES: Record<string, string> = {
+  '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.jpeg': 'image/jpeg',
+  '.webp': 'image/webp',
+  '.gif': 'image/gif',
+  '.zip': 'application/zip',
+  '.pdf': 'application/pdf',
+}
+
+// storage-redirect above only ever has a URL to redirect to *because*
+// the cloud provider already serves the bytes itself — AD_IMAGE_STORAGE=
+// local/ARCHIVE_STORAGE=local has no such external server at all, so
+// this route serves the bytes directly instead of redirecting anywhere,
+// giving local storage the same preview/download-button treatment
+// storage-redirect already gives gcs, instead of the bare filesystem
+// path a local ability result used to be stuck with (unopenable by
+// anything except direct server access).
+//
+// `path` is resolved against process.cwd() (this process's own working
+// directory — not this file's location, and not any one ability's own
+// AD_IMAGE_OUTPUT_DIR/ARCHIVE_OUTPUT_DIR specifically, since this route
+// has no idea which ability or env var produced the value it's given)
+// and then checked against that same root before anything is read —
+// this route is otherwise a generic "serve a file from this
+// deployment's own project directory," and skipping that check would
+// turn it into an arbitrary-file-read over HTTP. AD_IMAGE_OUTPUT_DIR/
+// ARCHIVE_OUTPUT_DIR left at their own defaults (a relative path) are
+// already under cwd, so this covers the common case with zero
+// configuration; a deployment pointing either at an absolute path
+// outside the project directory gets no preview/download URL for that
+// file at all — see generate_google_ad_images.ts's/create_zip_archive.ts's
+// own saveImage/saveArchive doc comments for that fallback.
+//
+// Same Basic Auth gate as every other route on this server — see
+// handleStorageRedirect's own doc comment for why that's what makes a
+// plain <img src="/local-file?..."> just work with no extra wiring.
+async function handleLocalFile(req: IncomingMessage, res: ServerResponse): Promise<void> {
+  const url = new URL(req.url ?? '/', 'http://localhost')
+  const relativePath = url.searchParams.get('path')
+  const disposition = url.searchParams.get('disposition')
+  const filename = url.searchParams.get('filename')
+
+  if (!relativePath) {
+    res.writeHead(400, { 'content-type': 'application/json' }).end(JSON.stringify({ error: 'local-file requires a path query param' }))
+    return
+  }
+  if (disposition && disposition !== 'inline' && disposition !== 'attachment') {
+    res.writeHead(400, { 'content-type': 'application/json' }).end(JSON.stringify({ error: `disposition must be "inline" or "attachment" — got "${disposition}"` }))
+    return
+  }
+
+  const root = process.cwd()
+  const resolved = resolvePath(root, relativePath)
+  if (resolved !== root && !resolved.startsWith(root + sep)) {
+    res.writeHead(403, { 'content-type': 'application/json' }).end(JSON.stringify({ error: 'local-file: path escapes this deployment\'s own project directory' }))
+    return
+  }
+
+  let stats: Awaited<ReturnType<typeof stat>>
+  try {
+    stats = await stat(resolved)
+  } catch {
+    res.writeHead(404, { 'content-type': 'application/json' }).end(JSON.stringify({ error: `local-file: no such file "${relativePath}"` }))
+    return
+  }
+  if (!stats.isFile()) {
+    res.writeHead(400, { 'content-type': 'application/json' }).end(JSON.stringify({ error: `local-file: "${relativePath}" is not a regular file` }))
+    return
+  }
+
+  const contentType = LOCAL_FILE_CONTENT_TYPES[extname(resolved).toLowerCase()] ?? 'application/octet-stream'
+  const headers: Record<string, string> = { 'content-type': contentType, 'content-length': String(stats.size) }
+  if (disposition === 'attachment') {
+    headers['content-disposition'] = `attachment; filename="${filename || relativePath.split('/').pop()}"`
+  }
+  res.writeHead(200, headers)
+  createReadStream(resolved).pipe(res)
+}
+
 const server = createServer(async (req, res) => {
   if (!isAuthorized(req)) {
     res
@@ -2489,6 +2596,10 @@ const server = createServer(async (req, res) => {
       await handleEnvPut(req, res, decodeURIComponent(envVarMatch[1]), decodeURIComponent(envVarMatch[2]))
       return
     }
+    if (envVarMatch && req.method === 'DELETE') {
+      await handleEnvDelete(res, decodeURIComponent(envVarMatch[1]), decodeURIComponent(envVarMatch[2]))
+      return
+    }
 
     // Backs the Admin UI's Abilities tab — see handleAbilitiesGet/
     // handleAbilitiesSearchGet/handleAbilityInstallPost's own doc
@@ -2560,6 +2671,11 @@ const server = createServer(async (req, res) => {
       return
     }
 
+    if (req.method === 'GET' && pathname === '/local-file') {
+      await handleLocalFile(req, res)
+      return
+    }
+
     const match = req.method === 'POST' && pathname.match(/^\/agents\/([^/]+)\/messages$/)
     if (!match) {
       res.writeHead(404, { 'content-type': 'application/json' }).end(JSON.stringify({ error: 'not found' }))