create-loopengine 0.1.46 → 0.1.47

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-loopengine",
-  "version": "0.1.46",
+  "version": "0.1.47",
   "description": "Scaffold a new loopengine agent project — a runnable HTTP server with one example agent, in your own repo.",
   "license": "MIT",
   "type": "module",

package/template/adapters/http.ts

@@ -93,6 +93,7 @@ import {
   SkillNotFoundError,
   listDeclaredEnvVars,
   setEnvVar,
+  unsetEnvVar,
   EnvVarNameError,
   readActauthConfig,
   addActauthRule,
@@ -1067,6 +1068,31 @@ async function handleEnvPut(req: IncomingMessage, res: ServerResponse, agentName
   res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ ok: true }))
 }
 
+// Same auth requirement as handleEnvPut above and the same reasoning —
+// removing a secret from .env is still a secrets-management action,
+// not just config, so this refuses outright rather than proceeding
+// open when LOOPENGINE_ADMIN_AUTH isn't configured at all.
+async function handleEnvDelete(res: ServerResponse, agentName: string, varName: string): Promise<void> {
+  if (!adminAuth) {
+    res.writeHead(403, { 'content-type': 'application/json' }).end(
+      JSON.stringify({ error: 'Refusing to unset an env var without LOOPENGINE_ADMIN_AUTH configured — set it before managing secrets through this route.' }),
+    )
+    return
+  }
+  if (!getEntry(agentName)) {
+    res.writeHead(404, { 'content-type': 'application/json' }).end(JSON.stringify({ error: `unknown agent '${agentName}'` }))
+    return
+  }
+  try {
+    unsetEnvVar(varName)
+  } catch (err) {
+    const status = err instanceof EnvVarNameError ? 400 : 500
+    res.writeHead(status, { 'content-type': 'application/json' }).end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }))
+    return
+  }
+  res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ ok: true }))
+}
+
 // A cheap, good-enough presence check — existsSync(node_modules/<dep>)
 // — rather than an actual module resolution (require.resolve/
 // import.meta.resolve): this only ever decides whether to show an
@@ -2570,6 +2596,10 @@ const server = createServer(async (req, res) => {
       await handleEnvPut(req, res, decodeURIComponent(envVarMatch[1]), decodeURIComponent(envVarMatch[2]))
       return
     }
+    if (envVarMatch && req.method === 'DELETE') {
+      await handleEnvDelete(res, decodeURIComponent(envVarMatch[1]), decodeURIComponent(envVarMatch[2]))
+      return
+    }
 
     // Backs the Admin UI's Abilities tab — see handleAbilitiesGet/
     // handleAbilitiesSearchGet/handleAbilityInstallPost's own doc