loopengine 0.1.28 → 0.1.30

package/README.md

@@ -1,6 +1,6 @@
 # LoopEngine
 
-[![CI](https://github.com/evanyan22/loopengine/actions/workflows/ci.yml/badge.svg)](https://github.com/evanyan22/loopengine/actions/workflows/ci.yml)
+[![CI](https://github.com/loopengine-co/loopengine/actions/workflows/ci.yml/badge.svg)](https://github.com/loopengine-co/loopengine/actions/workflows/ci.yml)
 
 LoopEngine is a runtime for building AI agents: a persona, a set of tools,
 and permission rules, run through a transparent ReAct loop. No chain DSL,

package/dist/bin/ability-manager.d.ts

@@ -52,6 +52,14 @@ export interface InstalledAbilityRecord {
      * this rather than storing/refetching full content to diff. */
     contentHashes: Record<string, string>;
 }
+/** Every ability currently installed for `agentName`, as recorded in
+ * .loopengine-abilities.json — powers the Admin UI's Abilities tab so an
+ * operator can see what's already there before installing something new
+ * (and get a clear collision error, via installAbility itself, rather
+ * than guessing blind). */
+export declare function listInstalledAbilities(agentName: string): Array<{
+    name: string;
+} & InstalledAbilityRecord>;
 /** `npm pack <spec>` + tar extract — generalized from
  * create-loopengine's own `fetchPublishedTemplateDir` (that function
  * only ever fetches the hardcoded `create-loopengine@<version>`; this

package/dist/bin/ability-manager.js

@@ -117,6 +117,34 @@ function matchesInstalledToolName(abilityName, manifestToolFile, installedToolNa
     const bareToolName = basename(manifestToolFile, '.ts');
     return bareToolName === installedToolName || namespacedToolName(abilityName, bareToolName) === installedToolName;
 }
+/** Two abilities can each declare a rule with the same bare `name` too —
+ * unlike a genuine `actauth` scope/tool/decision collision (which would
+ * be a real policy conflict worth refusing over), a bare *name* clash is
+ * just an addressing problem: `actauth`'s own Gate.evaluate()/
+ * RuleSet.resolve() never reads a rule's `name` at all (see
+ * models.js's own ruleSpecificity/scopeKey — resolution is entirely
+ * tool+scope+when), so two identically-named rules would never actually
+ * behave ambiguously at decision time. `name` only matters as
+ * addActauthRule's own lookup key (and the Admin UI's Actauth tab
+ * :ruleName route) — the same "it's an addressing problem, not a policy
+ * one" reasoning namespacedSkillId already applies to skill ids.
+ * Namespaced under the ability's own name only when the bare name is
+ * already taken, same fallback tools/skills already get; still refuses
+ * if even *that's* somehow already taken (two same-named installs of
+ * the same ability can't happen anyway — see AbilityAlreadyInstalledError
+ * above — so this only bites on a truly pathological manual edit). */
+function namespacedRuleName(abilityName, ruleName) {
+    return `${sanitizeForToolName(abilityName)}__${ruleName}`;
+}
+/** matchesInstalledToolName's own sibling for rules — upgradeAbility needs
+ * this to recompute forward from a freshly re-parsed manifest's bare rule
+ * name and compare against provenance's possibly-namespaced one, rather
+ * than comparing bare names directly (which would silently treat every
+ * namespaced rule as unmatched, reporting it 'unchanged' instead of
+ * actually diffing it against the new version). */
+function matchesInstalledRuleName(abilityName, manifestRuleName, installedRuleName) {
+    return manifestRuleName === installedRuleName || namespacedRuleName(abilityName, manifestRuleName) === installedRuleName;
+}
 function provenancePath(agentName) {
     return join(agentDir(agentName), '.loopengine-abilities.json');
 }
@@ -126,6 +154,15 @@ function readProvenance(agentName) {
         return {};
     return JSON.parse(readFileSync(path, 'utf8'));
 }
+/** Every ability currently installed for `agentName`, as recorded in
+ * .loopengine-abilities.json — powers the Admin UI's Abilities tab so an
+ * operator can see what's already there before installing something new
+ * (and get a clear collision error, via installAbility itself, rather
+ * than guessing blind). */
+export function listInstalledAbilities(agentName) {
+    const provenance = readProvenance(agentName);
+    return Object.entries(provenance).map(([name, record]) => ({ name, ...record }));
+}
 function writeProvenance(agentName, data) {
     writeFileSync(provenancePath(agentName), JSON.stringify(data, null, 2) + '\n');
 }
@@ -329,10 +366,18 @@ export async function installAbility(agentName, spec, options = {}) {
         skillIds.push(installedSkillId);
     }
     const existingRuleNames = new Set(readActauthConfig(agentName).rules.map((r) => r.name));
+    const ruleNames = [];
     for (const rule of rules) {
-        if (existingRuleNames.has(rule.name)) {
-            throw new AbilityCollisionError(`An actauth rule named '${rule.name}' already exists for '${agentName}'.`);
+        // The bare name if it's free; otherwise namespace under this
+        // ability's own name rather than refusing the install outright —
+        // see namespacedRuleName's own doc comment for why this is safe
+        // (a rule's `name` is an addressing key, not something `actauth`'s
+        // own resolution logic reads).
+        const installedRuleName = existingRuleNames.has(rule.name) ? namespacedRuleName(manifest.name, rule.name) : rule.name;
+        if (existingRuleNames.has(installedRuleName)) {
+            throw new AbilityCollisionError(`An actauth rule named '${installedRuleName}' already exists for '${agentName}'.`);
         }
+        ruleNames.push(installedRuleName);
     }
     const contentHashes = {};
     // Write tool files and patch tools/index.ts — pure filesystem
@@ -393,21 +438,25 @@ export async function installAbility(agentName, spec, options = {}) {
             contentHashes[`skills/${skillId}/SKILL.md`] = sha256(readFileSync(skillMdPath, 'utf8'));
         }
     }
-    // Append actauth rules.
-    for (const rule of rules) {
-        addActauthRule(agentName, rule);
+    // Append actauth rules — ruleNames[i] is rules[i]'s already-resolved
+    // installed name (bare, or namespaced under this ability's own name if
+    // the bare name collided — computed once, above, not recomputed here,
+    // so this loop can't disagree with the collision check that already
+    // ran against it, same reasoning the skills-copy loop above follows).
+    for (const [i, rule] of rules.entries()) {
+        addActauthRule(agentName, { ...rule, name: ruleNames[i] });
     }
     provenance[manifest.name] = {
         version: manifest.version,
         spec,
         tools: toolNames,
         skills: skillIds,
-        actauthRules: rules.map((r) => r.name),
+        actauthRules: ruleNames,
         env: manifest.env ?? [],
         contentHashes,
     };
     writeProvenance(agentName, provenance);
-    return { installed: [...toolNames.map((n) => `tools/${n}.ts`), ...skillIds.map((id) => `skills/${id}/`), ...rules.map((r) => `actauth:${r.name}`)] };
+    return { installed: [...toolNames.map((n) => `tools/${n}.ts`), ...skillIds.map((id) => `skills/${id}/`), ...ruleNames.map((n) => `actauth:${n}`)] };
 }
 // ---- Upgrade ----
 // git merge-file's own exit code *is* its conflict count (0 = clean),
@@ -557,8 +606,11 @@ export async function upgradeAbility(agentName, abilityName, options = {}) {
     const newRules = parseActauthRules(newDir, newManifest);
     const currentRules = new Map(readActauthConfig(agentName).rules.map((r) => [r.name, r]));
     for (const ruleName of record.actauthRules) {
-        const oldRule = oldRules.find((r) => r.name === ruleName);
-        const newRule = newRules.find((r) => r.name === ruleName);
+        // matchesInstalledRuleName, not a bare r.name === ruleName comparison
+        // — ruleName may be namespaced (see namespacedRuleName), and the
+        // freshly re-parsed old/new manifests only ever carry the bare name.
+        const oldRule = oldRules.find((r) => matchesInstalledRuleName(abilityName, r.name, ruleName));
+        const newRule = newRules.find((r) => matchesInstalledRuleName(abilityName, r.name, ruleName));
         const current = currentRules.get(ruleName);
         const path = `actauth:${ruleName}`;
         if (!oldRule || !newRule || !current) {

package/dist/web/abilities-admin.d.ts

@@ -0,0 +1,6 @@
+export interface PublicAbilitySearchResult {
+    name: string;
+    description: string;
+    version: string;
+}
+export declare function searchPublicAbilities(query?: string): Promise<PublicAbilitySearchResult[]>;

package/dist/web/abilities-admin.js

@@ -0,0 +1,26 @@
+const NPM_SEARCH_TIMEOUT_MS = 10000;
+const NPM_SEARCH_SIZE = 20;
+export async function searchPublicAbilities(query) {
+    const text = query ? `keywords:loopengine-ability ${query}` : 'keywords:loopengine-ability';
+    const url = `https://registry.npmjs.org/-/v1/search?text=${encodeURIComponent(text)}&size=${NPM_SEARCH_SIZE}`;
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), NPM_SEARCH_TIMEOUT_MS);
+    let res;
+    try {
+        res = await fetch(url, { signal: controller.signal });
+    }
+    catch (err) {
+        throw new Error(`Could not reach the npm registry: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+    if (!res.ok)
+        throw new Error(`npm registry search failed (HTTP ${res.status})`);
+    const data = (await res.json());
+    return (data.objects ?? []).map((o) => ({
+        name: o.package.name,
+        description: o.package.description ?? '',
+        version: o.package.version,
+    }));
+}

package/dist/web/agents-config-page.js

@@ -407,6 +407,8 @@ export const agentsConfigPageHtml = `<!doctype html>
   var actauthLoadedFor = null;
   // Same idea again, for the Environment tab's own GET .../env.
   var envLoadedFor = null;
+  // Same idea again, for the Abilities tab's own GET .../abilities.
+  var abilitiesLoadedFor = null;
   // The full /agents/:name/config response the currently-open agent was
   // last rendered from — kept around so refreshActauthDependentPanels/
   // refreshSkillsDependentPanels below can re-fetch and re-render just
@@ -1208,6 +1210,172 @@ export const agentsConfigPageHtml = `<!doctype html>
       });
   }
 
+  // ---- Abilities tab: what's already installed for this agent, a
+  // search box over public (npm, tagged loopengine-ability) packages,
+  // and a plain spec field for a private ability (a git URL, a local
+  // file:../path, or a private registry name) — both installs go
+  // through the same POST .../abilities, since installAbility itself
+  // already resolves any spec npm pack accepts (see
+  // bin/ability-manager.ts's own doc comment on fetchAbilityDir).
+  // Lazily loaded the same way Actauth/Environment are. ----
+
+  function renderAbilitiesTabPlaceholder() {
+    return '<section id="abilitiesSection"><div id="abilitiesContent"><p class="hint">Loading&hellip;</p></div></section>';
+  }
+
+  function renderInstalledAbilityRow(a) {
+    return '<tr>' +
+      '<td><code>' + escapeHtml(a.name) + '</code></td>' +
+      '<td>' + escapeHtml(a.version) + '</td>' +
+      '<td class="hint">' + escapeHtml((a.tools || []).join(', ')) + '</td>' +
+      '</tr>';
+  }
+
+  function renderAbilitySearchResultRow(pkg) {
+    return '<tr>' +
+      '<td><code>' + escapeHtml(pkg.name) + '</code> <span class="hint">' + escapeHtml(pkg.version) + '</span></td>' +
+      '<td>' + escapeHtml(pkg.description || '') + '</td>' +
+      '<td><button type="button" class="ability-install-btn" data-spec="' + escapeHtml(pkg.name) + '">Install</button></td>' +
+      '</tr>';
+  }
+
+  function renderAbilitiesConfigHtml(data) {
+    var installed = data.abilities || [];
+    var installedHtml = installed.length
+      ? '<table><thead><tr><th>Name</th><th>Version</th><th>Tools</th></tr></thead><tbody>' + installed.map(renderInstalledAbilityRow).join('') + '</tbody></table>'
+      : '<p class="hint">No abilities installed for this agent yet.</p>';
+
+    return '<h3>Installed</h3>' + installedHtml +
+      '<h3>Search public abilities</h3>' +
+      '<form id="abilitySearchForm" class="add-source">' +
+        '<input type="text" name="q" placeholder="Search by name or keyword (optional)">' +
+        '<button type="submit">Search</button>' +
+      '</form>' +
+      '<div id="abilitySearchResults"></div>' +
+      '<h3 style="margin-top:24px">Install from a spec</h3>' +
+      '<p class="hint">A git URL, a local <code>file:../path</code>, or a private npm package name/version — for anything not published publicly.</p>' +
+      '<form id="abilityInstallForm" class="add-source">' +
+        '<input type="text" name="spec" placeholder="e.g. git+https://github.com/org/repo.git or file:../my-ability" required>' +
+        '<button type="submit">Install</button>' +
+      '</form>' +
+      '<p id="abilityInstallStatus" class="hint"></p>';
+  }
+
+  function abilitiesContentEl() {
+    return detail.querySelector('#abilitiesContent');
+  }
+
+  // Shared by both the search-results "Install" button and the
+  // spec-form submit — same endpoint either way, installAbility itself
+  // doesn't distinguish "found via search" from "pasted directly".
+  function installAbilitySpec(name, spec, statusEl, btn) {
+    if (btn) { btn.disabled = true; }
+    statusEl.className = 'hint';
+    statusEl.textContent = 'Installing ' + spec + '…';
+    fetch('/agents/' + encodeURIComponent(name) + '/abilities', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ spec: spec }),
+    })
+      .then(function (r) { return r.json().then(function (j) { return { ok: r.ok, body: j }; }); })
+      .then(function (result) {
+        if (!result.ok) throw new Error(result.body.error || 'request failed');
+        // Same "is this dev or serve" distinction the CLI's own
+        // add-ability command prints after installing — a web install
+        // doesn't splice into an already-running server's in-memory
+        // registry any more than the CLI does (see installAbility's own
+        // doc comment on why), so the operator needs the same nudge here.
+        statusEl.textContent = 'Installed: ' + result.body.installed.join(', ') + '. Already running under npx loopengine dev? It becomes active automatically. Running under serve (or nothing yet)? Restart the server to pick it up.';
+        loadAbilitiesTab(name);
+      })
+      .catch(function (err) {
+        statusEl.className = 'error';
+        statusEl.textContent = 'Could not install: ' + err.message;
+        if (btn) { btn.disabled = false; }
+      });
+  }
+
+  // Shared by the initial (empty-query) load right after the tab opens
+  // and the search form's own submit — the empty-query case is just
+  // "list every published ability" (the keyword filter alone, no extra
+  // search text), so an operator sees what's out there immediately
+  // instead of having to search for something before anything shows up.
+  function runAbilitySearch(name, q, content, resultsEl) {
+    resultsEl.innerHTML = '<p class="hint">Loading&hellip;</p>';
+    fetch('/agents/' + encodeURIComponent(name) + '/abilities/search' + (q ? '?q=' + encodeURIComponent(q) : ''))
+      .then(function (r) { return r.json().then(function (j) { return { ok: r.ok, body: j }; }); })
+      .then(function (result) {
+        if (!result.ok) throw new Error(result.body.error || 'search failed');
+        var results = result.body.results || [];
+        resultsEl.innerHTML = results.length
+          ? '<table><thead><tr><th>Package</th><th>Description</th><th></th></tr></thead><tbody>' + results.map(renderAbilitySearchResultRow).join('') + '</tbody></table>'
+          : '<p class="hint">No public abilities found.</p>';
+        var installBtns = resultsEl.querySelectorAll('.ability-install-btn');
+        for (var i = 0; i < installBtns.length; i++) {
+          installBtns[i].addEventListener('click', function (ev2) {
+            var btn = ev2.currentTarget;
+            installAbilitySpec(name, btn.dataset.spec, content.querySelector('#abilityInstallStatus'), btn);
+          });
+        }
+      })
+      .catch(function (err) {
+        resultsEl.innerHTML = '<p class="error">' + escapeHtml(err.message) + '</p>';
+      });
+  }
+
+  function wireAbilitiesHandlers(name) {
+    var content = abilitiesContentEl();
+    if (!content) return;
+
+    var searchForm = content.querySelector('#abilitySearchForm');
+    var resultsEl = content.querySelector('#abilitySearchResults');
+    if (searchForm && resultsEl) {
+      searchForm.addEventListener('submit', function (ev) {
+        ev.preventDefault();
+        var q = new FormData(searchForm).get('q');
+        runAbilitySearch(name, q, content, resultsEl);
+      });
+      // List every published ability immediately, not just after the
+      // operator explicitly searches for something.
+      runAbilitySearch(name, '', content, resultsEl);
+    }
+
+    var installForm = content.querySelector('#abilityInstallForm');
+    if (installForm) {
+      installForm.addEventListener('submit', function (ev) {
+        ev.preventDefault();
+        var spec = new FormData(installForm).get('spec');
+        var statusEl = content.querySelector('#abilityInstallStatus');
+        var btn = installForm.querySelector('button[type="submit"]');
+        installAbilitySpec(name, spec, statusEl, btn);
+      });
+    }
+  }
+
+  function applyAbilitiesConfig(name, data) {
+    var content = abilitiesContentEl();
+    if (!content) return;
+    content.innerHTML = renderAbilitiesConfigHtml(data);
+    wireAbilitiesHandlers(name);
+    abilitiesLoadedFor = name;
+  }
+
+  function loadAbilitiesTab(name) {
+    var content = abilitiesContentEl();
+    if (!content) return;
+    content.innerHTML = '<p class="hint">Loading&hellip;</p>';
+    fetch('/agents/' + encodeURIComponent(name) + '/abilities')
+      .then(function (r) { return r.json(); })
+      .then(function (data) {
+        if (currentName !== name) return;
+        applyAbilitiesConfig(name, data);
+      })
+      .catch(function (err) {
+        if (currentName !== name) return;
+        content.innerHTML = '<p class="error">Could not load abilities: ' + escapeHtml(err.message) + '</p>';
+      });
+  }
+
   // ---- Skills tab: editable — add/edit/delete SKILL.md files via
   // skills-admin.ts, restricted (see that file's own doc comment) to
   // flat, non-nested skill ids. Unlike the Tools tab's Gateway Tools
@@ -1995,6 +2163,9 @@ export const agentsConfigPageHtml = `<!doctype html>
     if (tab === 'env' && envLoadedFor !== currentName) {
       loadEnvTab(currentName);
     }
+    if (tab === 'abilities' && abilitiesLoadedFor !== currentName) {
+      loadAbilitiesTab(currentName);
+    }
   }
 
   // Refreshes just Overview's own summary — used after anything that
@@ -2070,13 +2241,15 @@ export const agentsConfigPageHtml = `<!doctype html>
         '<button class="tab" data-tab="skills">Skills</button>' +
         '<button class="tab" data-tab="tools">Tools</button>' +
         '<button class="tab" data-tab="actauth">ActAuth</button>' +
+        '<button class="tab" data-tab="abilities">Abilities</button>' +
         '<button class="tab" data-tab="env">Environment</button>' +
       '</div>' +
       '<div class="tab-panel" data-tab-panel="overview">' + renderOverviewHtml(cfg) + '</div>' +
       '<div class="tab-panel" data-tab-panel="skills">' + renderSkillsTabHtml(cfg) + '</div>' +
       '<div class="tab-panel" data-tab-panel="tools">' + renderToolsTabHtml(cfg) + '</div>' +
       '<div class="tab-panel" data-tab-panel="actauth">' + renderActauthTabPlaceholder() + '</div>' +
-      '<div class="tab-panel" data-tab-panel="env">' + renderEnvTabPlaceholder() + '</div>';
+      '<div class="tab-panel" data-tab-panel="env">' + renderEnvTabPlaceholder() + '</div>' +
+      '<div class="tab-panel" data-tab-panel="abilities">' + renderAbilitiesTabPlaceholder() + '</div>';
 
     var buttons = detail.querySelectorAll('.tabs button');
     for (var i = 0; i < buttons.length; i++) {
@@ -2101,6 +2274,7 @@ export const agentsConfigPageHtml = `<!doctype html>
     gatewayLoadedFor = null;
     actauthLoadedFor = null;
     envLoadedFor = null;
+    abilitiesLoadedFor = null;
     var items = agentList.querySelectorAll('li');
     for (var i = 0; i < items.length; i++) {
       items[i].classList.toggle('active', items[i].dataset.name === name);

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "loopengine",
-  "version": "0.1.28",
+  "version": "0.1.30",
   "type": "module",
   "description": "Runtime for tool-using AI agents with a transparent ReAct loop.",
   "license": "MIT",
   "homepage": "https://loopengine.co",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/evanyan22/loopengine.git"
+    "url": "git+https://github.com/loopengine-co/loopengine.git"
   },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",