create-loopengine 0.1.57 → 0.1.59

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-loopengine",
-  "version": "0.1.57",
+  "version": "0.1.59",
   "description": "Scaffold a new loopengine agent project — a runnable HTTP server with one example agent, in your own repo.",
   "license": "MIT",
   "type": "module",

package/template/adapters/http.ts

@@ -153,6 +153,9 @@ import {
   searchPublicAbilities,
   fetchLatestAbilityVersion,
   describeModelProviders,
+  setModelProviderKey,
+  clearModelProviderKey,
+  ModelKeyError,
   describeGateways,
   scaffoldAgent,
   AgentNameError,
@@ -2786,6 +2789,13 @@ const server = createServer(async (req, res) => {
     // web/playground.ts. GET, not POST, and an exact path match
     // (neither has a :name segment), so no risk of colliding with the
     // regexes above (already partitioned by method).
+    // The bare address is the console itself, the same page as
+    // /agents/config (all its links and requests use absolute paths).
+    if (req.method === 'GET' && pathname === '/') {
+      res.writeHead(200, { 'content-type': 'text/html' }).end(agentsConfigPageHtml)
+      return
+    }
+
     if (req.method === 'GET' && pathname === '/playground') {
       res.writeHead(200, { 'content-type': 'text/html' }).end(playgroundHtml)
       return
@@ -2975,7 +2985,31 @@ const server = createServer(async (req, res) => {
       return
     }
     if (req.method === 'GET' && pathname === '/config/models') {
-      res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify(describeModelProviders(listAgents(), (name) => getEntry(name)?.config)))
+      res.writeHead(200, { 'content-type': 'application/json' }).end(
+        JSON.stringify({ ...describeModelProviders(listAgents(), (name) => getEntry(name)?.config), canSave: secretsProtected }),
+      )
+      return
+    }
+    // A provider's API key, from the Models page: write-only, never read
+    // back. Same rule as the Environment tab: refused on a server with no
+    // auth, since anyone who could reach it could replace the key.
+    const modelKeyMatch = (req.method === 'PUT' || req.method === 'DELETE') && pathname.match(/^\/config\/models\/([a-z]+)\/key$/)
+    if (modelKeyMatch) {
+      if (!secretsProtected) {
+        res.writeHead(403, { 'content-type': 'application/json' }).end(
+          JSON.stringify({ error: 'Refusing to store an API key without LOOPENGINE_ADMIN_AUTH configured: set it first, or put the key in .env.' }),
+        )
+        return
+      }
+      try {
+        if (req.method === 'PUT') await setModelProviderKey(modelKeyMatch[1], (await readJsonBody(req)).key)
+        else await clearModelProviderKey(modelKeyMatch[1])
+      } catch (err) {
+        const status = err instanceof ModelKeyError ? 400 : 500
+        res.writeHead(status, { 'content-type': 'application/json' }).end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }))
+        return
+      }
+      res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ ok: true }))
       return
     }
     if (req.method === 'GET' && pathname === '/config/gateways') {

package/template/package.json

@@ -9,7 +9,7 @@
     "cli": "tsx adapters/cli.ts"
   },
   "dependencies": {
-    "loopengine": "^0.1.71",
+    "loopengine": "^0.1.74",
     "actauth": "^0.0.12"
   },
   "devDependencies": {