loopengine 0.1.32 → 0.1.34

package/dist/bin/ability-manager.d.ts

@@ -27,6 +27,17 @@ export interface AbilityManifest {
     skills?: string[];
     actauth?: string;
     env?: AbilityEnvDecl[];
+    /** Real npm package names (dependencies + optionalDependencies) the
+     * ability's own tool files import — read off package.json, not
+     * declared in loopengine.ability.json itself. installAbility only
+     * ever copies the ability's *files* into the consuming project, never
+     * touches its package.json/node_modules (see installAbility's own
+     * doc comment for why), so a tool that imports a real package like
+     * `sharp` will fail at runtime with a bare "Cannot find package"
+     * error unless the operator separately runs `npm install` for it —
+     * this is what lets a caller (the Admin UI's Abilities tab) warn
+     * about that up front instead of leaving it as a silent trap. */
+    dependencies?: string[];
 }
 /** One agent's record of one installed ability — the merge base a
  * future upgrade needs, what remove needs to know is safe to delete,
@@ -112,6 +123,7 @@ export interface FetchOptions {
  * install is refused, before a single file is written. */
 export declare function installAbility(agentName: string, spec: string, options?: FetchOptions): Promise<{
     installed: string[];
+    dependencies: string[];
 }>;
 export interface UpgradeFileResult {
     path: string;

package/dist/bin/ability-manager.js

@@ -212,7 +212,8 @@ function readManifest(abilityDir) {
     if (!pkgJson.name || !pkgJson.version) {
         throw new AbilityManifestError(`${pkgJsonPath} must have "name" and "version".`);
     }
-    return { ...declared, name: pkgJson.name, version: pkgJson.version };
+    const dependencies = [...Object.keys(pkgJson.dependencies ?? {}), ...Object.keys(pkgJson.optionalDependencies ?? {})];
+    return { ...declared, name: pkgJson.name, version: pkgJson.version, dependencies };
 }
 // The installing project's own dependencies.loopengine is itself a
 // range (e.g. "^0.1.10"), not a concrete installed version — checking
@@ -456,7 +457,10 @@ export async function installAbility(agentName, spec, options = {}) {
         contentHashes,
     };
     writeProvenance(agentName, provenance);
-    return { installed: [...toolNames.map((n) => `tools/${n}.ts`), ...skillIds.map((id) => `skills/${id}/`), ...ruleNames.map((n) => `actauth:${n}`)] };
+    return {
+        installed: [...toolNames.map((n) => `tools/${n}.ts`), ...skillIds.map((id) => `skills/${id}/`), ...ruleNames.map((n) => `actauth:${n}`)],
+        dependencies: manifest.dependencies ?? [],
+    };
 }
 // ---- Upgrade ----
 // git merge-file's own exit code *is* its conflict count (0 = clean),

package/dist/web/agents-config-page.js

@@ -1285,7 +1285,19 @@ export const agentsConfigPageHtml = `<!doctype html>
         // doesn't splice into an already-running server's in-memory
         // registry any more than the CLI does (see installAbility's own
         // doc comment on why), so the operator needs the same nudge here.
-        statusEl.textContent = 'Installed: ' + result.body.installed.join(', ') + '. Already running under npx loopengine dev? It becomes active automatically. Running under serve (or nothing yet)? Restart the server to pick it up.';
+        var message = 'Installed: ' + escapeHtml(result.body.installed.join(', ')) + '. Already running under npx loopengine dev? It becomes active automatically. Running under serve (or nothing yet)? Restart the server to pick it up.';
+        var deps = result.body.dependencies || [];
+        if (deps.length) {
+          // installAbility only ever copies the ability's own files —
+          // never touches package.json/node_modules — so a real npm
+          // dependency the ability's own tool code imports (e.g. sharp)
+          // has to be installed separately, or the tool fails at runtime
+          // with an opaque "Cannot find package" the very next time this
+          // agent's config is loaded. Surfaced here, loudly, instead of
+          // leaving that as a silent trap discovered later.
+          message += ' <strong>This ability also needs: <code>npm install ' + escapeHtml(deps.join(' ')) + '</code></strong> in your own project before it will actually work.';
+        }
+        statusEl.innerHTML = message;
         loadAbilitiesTab(name);
       })
       .catch(function (err) {
@@ -2175,9 +2187,14 @@ export const agentsConfigPageHtml = `<!doctype html>
   // so only Overview is left needing a re-fetch.
   function refreshOverviewPanel(name) {
     fetch('/agents/' + encodeURIComponent(name) + '/config')
-      .then(function (r) { return r.json(); })
-      .then(function (cfg) {
+      .then(function (r) { return r.json().then(function (j) { return { ok: r.ok, body: j }; }); })
+      .then(function (result) {
         if (currentName !== name) return;
+        // A non-ok body is {error: "..."}, not a real config — bail out
+        // to the catch below rather than rendering it as one (same risk
+        // selectAgent's own /config fetch has — see its own comment).
+        if (!result.ok) throw new Error(result.body.error || 'request failed');
+        var cfg = result.body;
         currentCfg = cfg;
         var overviewPanel = detail.querySelector('[data-tab-panel="overview"]');
         if (overviewPanel) {
@@ -2213,9 +2230,13 @@ export const agentsConfigPageHtml = `<!doctype html>
   // re-rendering both it and Overview from a fresh /config fetch.
   function refreshSkillsDependentPanels(name) {
     fetch('/agents/' + encodeURIComponent(name) + '/config')
-      .then(function (r) { return r.json(); })
-      .then(function (cfg) {
+      .then(function (r) { return r.json().then(function (j) { return { ok: r.ok, body: j }; }); })
+      .then(function (result) {
         if (currentName !== name) return;
+        // Same "don't render an {error: ...} body as if it were a real
+        // config" guard as refreshOverviewPanel/selectAgent above.
+        if (!result.ok) throw new Error(result.body.error || 'request failed');
+        var cfg = result.body;
         currentCfg = cfg;
         var overviewPanel = detail.querySelector('[data-tab-panel="overview"]');
         var skillsPanel = skillsPanelEl();
@@ -2283,10 +2304,18 @@ export const agentsConfigPageHtml = `<!doctype html>
     empty.style.display = 'none';
     detail.style.display = 'block';
     fetch('/agents/' + encodeURIComponent(name) + '/config')
-      .then(function (r) { return r.json(); })
-      .then(function (cfg) {
+      .then(function (r) { return r.json().then(function (j) { return { ok: r.ok, body: j }; }); })
+      .then(function (result) {
         if (currentName !== name) return;
-        renderDetail(cfg);
+        // A non-ok response's body is {error: "..."}, not a real config
+        // — rendering it as one would crash somewhere deep in
+        // renderDetail (e.g. reading .model.provider off an object with
+        // no .model at all) with a confusing, unrelated-looking message
+        // instead of the actual server-side error this route already
+        // went out of its way to surface clearly (see handleAgentConfig
+        // Get's own doc comment).
+        if (!result.ok) throw new Error(result.body.error || 'request failed');
+        renderDetail(result.body);
       })
       .catch(function (err) {
         if (currentName !== name) return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loopengine",
-  "version": "0.1.32",
+  "version": "0.1.34",
   "type": "module",
   "description": "Runtime for tool-using AI agents with a transparent ReAct loop.",
   "license": "MIT",