loopengine 0.1.31 → 0.1.33

package/dist/bin/ability-manager.d.ts

@@ -27,6 +27,17 @@ export interface AbilityManifest {
     skills?: string[];
     actauth?: string;
     env?: AbilityEnvDecl[];
+    /** Real npm package names (dependencies + optionalDependencies) the
+     * ability's own tool files import — read off package.json, not
+     * declared in loopengine.ability.json itself. installAbility only
+     * ever copies the ability's *files* into the consuming project, never
+     * touches its package.json/node_modules (see installAbility's own
+     * doc comment for why), so a tool that imports a real package like
+     * `sharp` will fail at runtime with a bare "Cannot find package"
+     * error unless the operator separately runs `npm install` for it —
+     * this is what lets a caller (the Admin UI's Abilities tab) warn
+     * about that up front instead of leaving it as a silent trap. */
+    dependencies?: string[];
 }
 /** One agent's record of one installed ability — the merge base a
  * future upgrade needs, what remove needs to know is safe to delete,
@@ -112,6 +123,7 @@ export interface FetchOptions {
  * install is refused, before a single file is written. */
 export declare function installAbility(agentName: string, spec: string, options?: FetchOptions): Promise<{
     installed: string[];
+    dependencies: string[];
 }>;
 export interface UpgradeFileResult {
     path: string;

package/dist/bin/ability-manager.js

@@ -212,7 +212,8 @@ function readManifest(abilityDir) {
     if (!pkgJson.name || !pkgJson.version) {
         throw new AbilityManifestError(`${pkgJsonPath} must have "name" and "version".`);
     }
-    return { ...declared, name: pkgJson.name, version: pkgJson.version };
+    const dependencies = [...Object.keys(pkgJson.dependencies ?? {}), ...Object.keys(pkgJson.optionalDependencies ?? {})];
+    return { ...declared, name: pkgJson.name, version: pkgJson.version, dependencies };
 }
 // The installing project's own dependencies.loopengine is itself a
 // range (e.g. "^0.1.10"), not a concrete installed version — checking
@@ -456,7 +457,10 @@ export async function installAbility(agentName, spec, options = {}) {
         contentHashes,
     };
     writeProvenance(agentName, provenance);
-    return { installed: [...toolNames.map((n) => `tools/${n}.ts`), ...skillIds.map((id) => `skills/${id}/`), ...ruleNames.map((n) => `actauth:${n}`)] };
+    return {
+        installed: [...toolNames.map((n) => `tools/${n}.ts`), ...skillIds.map((id) => `skills/${id}/`), ...ruleNames.map((n) => `actauth:${n}`)],
+        dependencies: manifest.dependencies ?? [],
+    };
 }
 // ---- Upgrade ----
 // git merge-file's own exit code *is* its conflict count (0 = clean),

package/dist/web/abilities-admin.js

@@ -18,9 +18,23 @@ export async function searchPublicAbilities(query) {
     if (!res.ok)
         throw new Error(`npm registry search failed (HTTP ${res.status})`);
     const data = (await res.json());
-    return (data.objects ?? []).map((o) => ({
+    const results = (data.objects ?? []).map((o) => ({
         name: o.package.name,
         description: o.package.description ?? '',
         version: o.package.version,
     }));
+    // npm's own search is a relevance *ranker*, not a filter — a query
+    // like "keywords:loopengine-ability docs" boosts a matching package's
+    // score but doesn't drop the non-matching ones from the response at
+    // all (confirmed live: every ability in this ecosystem still came
+    // back regardless of the extra query text, just reordered). With this
+    // few, brand-new, all-zero-download packages, that reordering barely
+    // moves, so an operator typing a search term would otherwise see the
+    // exact same full list every time. Filtering here on name/description
+    // gives the strict, expected "search box" behavior npm's own API
+    // doesn't provide on its own.
+    if (!query)
+        return results;
+    const needle = query.toLowerCase();
+    return results.filter((r) => r.name.toLowerCase().includes(needle) || r.description.toLowerCase().includes(needle));
 }

package/dist/web/agents-config-page.js

@@ -1285,7 +1285,19 @@ export const agentsConfigPageHtml = `<!doctype html>
         // doesn't splice into an already-running server's in-memory
         // registry any more than the CLI does (see installAbility's own
         // doc comment on why), so the operator needs the same nudge here.
-        statusEl.textContent = 'Installed: ' + result.body.installed.join(', ') + '. Already running under npx loopengine dev? It becomes active automatically. Running under serve (or nothing yet)? Restart the server to pick it up.';
+        var message = 'Installed: ' + escapeHtml(result.body.installed.join(', ')) + '. Already running under npx loopengine dev? It becomes active automatically. Running under serve (or nothing yet)? Restart the server to pick it up.';
+        var deps = result.body.dependencies || [];
+        if (deps.length) {
+          // installAbility only ever copies the ability's own files —
+          // never touches package.json/node_modules — so a real npm
+          // dependency the ability's own tool code imports (e.g. sharp)
+          // has to be installed separately, or the tool fails at runtime
+          // with an opaque "Cannot find package" the very next time this
+          // agent's config is loaded. Surfaced here, loudly, instead of
+          // leaving that as a silent trap discovered later.
+          message += ' <strong>This ability also needs: <code>npm install ' + escapeHtml(deps.join(' ')) + '</code></strong> in your own project before it will actually work.';
+        }
+        statusEl.innerHTML = message;
         loadAbilitiesTab(name);
       })
       .catch(function (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loopengine",
-  "version": "0.1.31",
+  "version": "0.1.33",
   "type": "module",
   "description": "Runtime for tool-using AI agents with a transparent ReAct loop.",
   "license": "MIT",