create-loopengine 0.1.46 → 0.1.48

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-loopengine",
-  "version": "0.1.46",
+  "version": "0.1.48",
   "description": "Scaffold a new loopengine agent project — a runnable HTTP server with one example agent, in your own repo.",
   "license": "MIT",
   "type": "module",

package/template/adapters/http.ts

@@ -93,6 +93,7 @@ import {
   SkillNotFoundError,
   listDeclaredEnvVars,
   setEnvVar,
+  unsetEnvVar,
   EnvVarNameError,
   readActauthConfig,
   addActauthRule,
@@ -103,6 +104,7 @@ import {
   ActauthRuleNotFoundError,
   installAbility,
   upgradeAbility,
+  removeAbility,
   listInstalledAbilities,
   backfillDependencies,
   AbilityAlreadyInstalledError,
@@ -1067,6 +1069,31 @@ async function handleEnvPut(req: IncomingMessage, res: ServerResponse, agentName
   res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ ok: true }))
 }
 
+// Same auth requirement as handleEnvPut above and the same reasoning —
+// removing a secret from .env is still a secrets-management action,
+// not just config, so this refuses outright rather than proceeding
+// open when LOOPENGINE_ADMIN_AUTH isn't configured at all.
+async function handleEnvDelete(res: ServerResponse, agentName: string, varName: string): Promise<void> {
+  if (!adminAuth) {
+    res.writeHead(403, { 'content-type': 'application/json' }).end(
+      JSON.stringify({ error: 'Refusing to unset an env var without LOOPENGINE_ADMIN_AUTH configured — set it before managing secrets through this route.' }),
+    )
+    return
+  }
+  if (!getEntry(agentName)) {
+    res.writeHead(404, { 'content-type': 'application/json' }).end(JSON.stringify({ error: `unknown agent '${agentName}'` }))
+    return
+  }
+  try {
+    unsetEnvVar(varName)
+  } catch (err) {
+    const status = err instanceof EnvVarNameError ? 400 : 500
+    res.writeHead(status, { 'content-type': 'application/json' }).end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }))
+    return
+  }
+  res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ ok: true }))
+}
+
 // A cheap, good-enough presence check — existsSync(node_modules/<dep>)
 // — rather than an actual module resolution (require.resolve/
 // import.meta.resolve): this only ever decides whether to show an
@@ -1202,6 +1229,34 @@ async function handleAbilityUpgradePost(req: IncomingMessage, res: ServerRespons
   }
 }
 
+// Uninstalls an ability — deletes its tool/skill files and actauth
+// rules (bin/ability-manager.ts's own removeAbility). Same admin-auth
+// posture as install/upgrade above: this mutates the agent's own tree,
+// even though — unlike install/upgrade — it never runs new third-party
+// code. `removed`/`refused` pass straight through on success (not an
+// error: a dirty file left in place, same as remove-ability's own CLI
+// behavior, is a normal partial outcome the Admin UI shows and offers
+// to retry with force, not a failure).
+async function handleAbilityUninstallDelete(res: ServerResponse, agentName: string, abilityName: string, force: boolean): Promise<void> {
+  if (!adminAuth) {
+    res.writeHead(403, { 'content-type': 'application/json' }).end(
+      JSON.stringify({ error: 'Refusing to uninstall an ability without LOOPENGINE_ADMIN_AUTH configured — set it before uninstalling abilities through this route.' }),
+    )
+    return
+  }
+  if (!getEntry(agentName)) {
+    res.writeHead(404, { 'content-type': 'application/json' }).end(JSON.stringify({ error: `unknown agent '${agentName}'` }))
+    return
+  }
+  try {
+    const result = removeAbility(agentName, abilityName, force)
+    res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify(result))
+  } catch (err) {
+    const status = err instanceof AbilityNotInstalledError ? 404 : 500
+    res.writeHead(status, { 'content-type': 'application/json' }).end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }))
+  }
+}
+
 const execFileAsync = promisify(execFile)
 const NPM_INSTALL_DEPS_TIMEOUT_MS = 180_000
 
@@ -2570,6 +2625,10 @@ const server = createServer(async (req, res) => {
       await handleEnvPut(req, res, decodeURIComponent(envVarMatch[1]), decodeURIComponent(envVarMatch[2]))
       return
     }
+    if (envVarMatch && req.method === 'DELETE') {
+      await handleEnvDelete(res, decodeURIComponent(envVarMatch[1]), decodeURIComponent(envVarMatch[2]))
+      return
+    }
 
     // Backs the Admin UI's Abilities tab — see handleAbilitiesGet/
     // handleAbilitiesSearchGet/handleAbilityInstallPost's own doc
@@ -2594,6 +2653,12 @@ const server = createServer(async (req, res) => {
       await handleAbilityInstallDepsPost(req, res, decodeURIComponent(abilityInstallDepsMatch[1]), decodeURIComponent(abilityInstallDepsMatch[2]))
       return
     }
+    const abilityMatch = pathname.match(/^\/agents\/([^/]+)\/abilities\/([^/]+)$/)
+    if (abilityMatch && req.method === 'DELETE') {
+      const force = new URL(req.url ?? '/', 'http://localhost').searchParams.get('force') === 'true'
+      await handleAbilityUninstallDelete(res, decodeURIComponent(abilityMatch[1]), decodeURIComponent(abilityMatch[2]), force)
+      return
+    }
     const abilitiesMatch = pathname.match(/^\/agents\/([^/]+)\/abilities$/)
     if (abilitiesMatch && req.method === 'GET') {
       await handleAbilitiesGet(res, decodeURIComponent(abilitiesMatch[1]))