loopengine 0.1.39 → 0.1.42

package/dist/bin/ability-manager.d.ts

@@ -63,6 +63,14 @@ export interface InstalledAbilityRecord {
     skills: string[];
     actauthRules: string[];
     env: AbilityEnvDecl[];
+    /** Real npm package names (dependencies + optionalDependencies) the
+     * ability's own tool files import, as of the last install/upgrade —
+     * same values AbilityManifest.dependencies carries, persisted here so
+     * the Admin UI's "Install dependencies" button can read them back
+     * without refetching the ability from its spec. Optional only because
+     * an ability installed before this field existed has no recorded
+     * value. */
+    dependencies?: string[];
     /** relative path (e.g. "tools/foo.ts") -> sha256 hex, as of the last
      * install/upgrade — remove-ability's dirty-check compares against
      * this rather than storing/refetching full content to diff. */

package/dist/bin/ability-manager.js

@@ -454,6 +454,7 @@ export async function installAbility(agentName, spec, options = {}) {
         skills: skillIds,
         actauthRules: ruleNames,
         env: manifest.env ?? [],
+        dependencies: manifest.dependencies ?? [],
         contentHashes,
     };
     writeProvenance(agentName, provenance);
@@ -633,7 +634,14 @@ export async function upgradeAbility(agentName, abilityName, options = {}) {
         updateActauthRule(agentName, ruleName, { scope: newRule.scope, tool: newRule.tool, decision: newRule.decision });
         results.push({ path, status: 'updated' });
     }
-    provenance[abilityName] = { ...record, version: newManifest.version, spec, contentHashes: newContentHashes, env: newManifest.env ?? record.env };
+    provenance[abilityName] = {
+        ...record,
+        version: newManifest.version,
+        spec,
+        contentHashes: newContentHashes,
+        env: newManifest.env ?? record.env,
+        dependencies: newManifest.dependencies ?? record.dependencies,
+    };
     writeProvenance(agentName, provenance);
     return { files: results };
 }

package/dist/index.d.ts

@@ -59,7 +59,7 @@ export { readActauthConfig, addActauthRule, updateActauthRule, removeActauthRule
 export type { ActauthRuleInput, ActauthConfigView } from './web/actauth-admin.js';
 export { installAbility, upgradeAbility, listInstalledAbilities, AbilityManifestError, AbilityVersionError, AbilityCollisionError, AbilityAlreadyInstalledError, AbilityNotInstalledError, } from './bin/ability-manager.js';
 export type { InstalledAbilityRecord, AbilityEnvDecl, UpgradeFileResult } from './bin/ability-manager.js';
-export { searchPublicAbilities } from './web/abilities-admin.js';
+export { searchPublicAbilities, fetchLatestAbilityVersion } from './web/abilities-admin.js';
 export type { PublicAbilitySearchResult } from './web/abilities-admin.js';
 export { describeModelProviders, describeGateways } from './web/global-config.js';
 export type { ModelProviderInfo, AgentModelUsage, ModelsView, GatewayProviderInfo, GatewaysView } from './web/global-config.js';

package/dist/index.js

@@ -52,7 +52,7 @@ export { readSkill, writeSkill, deleteSkill, SkillInvalidIdError, SkillNotFoundE
 export { listDeclaredEnvVars, setEnvVar, EnvVarNameError } from './web/env-admin.js';
 export { readActauthConfig, addActauthRule, updateActauthRule, removeActauthRule, setDefaultDecision, ActauthRuleExistsError, ActauthRuleNotFoundError, } from './web/actauth-admin.js';
 export { installAbility, upgradeAbility, listInstalledAbilities, AbilityManifestError, AbilityVersionError, AbilityCollisionError, AbilityAlreadyInstalledError, AbilityNotInstalledError, } from './bin/ability-manager.js';
-export { searchPublicAbilities } from './web/abilities-admin.js';
+export { searchPublicAbilities, fetchLatestAbilityVersion } from './web/abilities-admin.js';
 export { describeModelProviders, describeGateways } from './web/global-config.js';
 export { createTrackedApprover, listApprovals, decideApproval, findApproval } from './web/web-approver.js';
 export { scaffoldAgent, scaffoldSubagent, AgentNameError, AgentExistsError, AgentNotFoundError, AgentModelError } from './bin/cli.js';

package/dist/web/abilities-admin.d.ts

@@ -4,3 +4,12 @@ export interface PublicAbilitySearchResult {
     version: string;
 }
 export declare function searchPublicAbilities(query?: string): Promise<PublicAbilitySearchResult[]>;
+/** The latest version currently published on the public npm registry for
+ * `packageName`, or null if it can't be determined — not published
+ * there at all (a private/file:/git-installed ability, the common case
+ * during local development), a network hiccup, or a timeout. Best-effort
+ * only: the Abilities tab uses this to decide whether an installed
+ * ability's own "Upgrade" button is worth showing, not to block
+ * anything, so a failure here surfaces as "can't tell, show the button
+ * anyway" rather than an error the operator has to deal with. */
+export declare function fetchLatestAbilityVersion(packageName: string): Promise<string | null>;

package/dist/web/abilities-admin.js

@@ -38,3 +38,29 @@ export async function searchPublicAbilities(query) {
     const needle = query.toLowerCase();
     return results.filter((r) => r.name.toLowerCase().includes(needle) || r.description.toLowerCase().includes(needle));
 }
+const NPM_LATEST_VERSION_TIMEOUT_MS = 5000;
+/** The latest version currently published on the public npm registry for
+ * `packageName`, or null if it can't be determined — not published
+ * there at all (a private/file:/git-installed ability, the common case
+ * during local development), a network hiccup, or a timeout. Best-effort
+ * only: the Abilities tab uses this to decide whether an installed
+ * ability's own "Upgrade" button is worth showing, not to block
+ * anything, so a failure here surfaces as "can't tell, show the button
+ * anyway" rather than an error the operator has to deal with. */
+export async function fetchLatestAbilityVersion(packageName) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), NPM_LATEST_VERSION_TIMEOUT_MS);
+    try {
+        const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}/latest`, { signal: controller.signal });
+        if (!res.ok)
+            return null;
+        const data = (await res.json());
+        return typeof data.version === 'string' ? data.version : null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}

package/dist/web/agents-config-page.js

@@ -1288,19 +1288,39 @@ export const agentsConfigPageHtml = `<!doctype html>
   }
 
   function renderInstalledAbilityRow(a) {
+    // a.upToDate only ever comes back true when the npm registry lookup
+    // (handleAbilitiesGet's own fetchLatestAbilityVersion) actually
+    // succeeded and matched — a private/file:/git-installed ability, or
+    // any registry hiccup, leaves it false, so the button still shows
+    // rather than silently hiding on an unknown instead of a genuine
+    // "nothing to upgrade".
+    var actionHtml = a.upToDate
+      ? '<span class="hint">up to date</span>'
+      : '<button type="button" class="ability-upgrade-btn" data-name="' + escapeHtml(a.name) + '">Upgrade</button>';
+    // Same reasoning as upToDate above — missingDependencies (see
+    // hasNodeModule) only ever hides this once the server actually
+    // found every dependency already present in node_modules; anything
+    // it can't confirm still shows the button.
+    var deps = a.missingDependencies || [];
+    if (deps.length) {
+      actionHtml += ' <button type="button" class="ability-install-deps-btn" data-name="' + escapeHtml(a.name) + '" title="npm install ' + escapeHtml(deps.join(' ')) + '">Install deps</button>';
+    }
     return '<tr>' +
       '<td><code>' + escapeHtml(a.name) + '</code></td>' +
       '<td>' + escapeHtml(a.version) + '</td>' +
       '<td class="hint">' + escapeHtml((a.tools || []).join(', ')) + '</td>' +
-      '<td><button type="button" class="ability-upgrade-btn" data-name="' + escapeHtml(a.name) + '">Upgrade</button></td>' +
+      '<td>' + actionHtml + '</td>' +
       '</tr>';
   }
 
-  function renderAbilitySearchResultRow(pkg) {
+  function renderAbilitySearchResultRow(pkg, installedNames) {
+    var actionHtml = installedNames.indexOf(pkg.name) !== -1
+      ? '<span class="hint">Installed</span>'
+      : '<button type="button" class="ability-install-btn" data-spec="' + escapeHtml(pkg.name) + '">Install</button>';
     return '<tr>' +
       '<td><code>' + escapeHtml(pkg.name) + '</code> <span class="hint">' + escapeHtml(pkg.version) + '</span></td>' +
       '<td>' + escapeHtml(pkg.description || '') + '</td>' +
-      '<td><button type="button" class="ability-install-btn" data-spec="' + escapeHtml(pkg.name) + '">Install</button></td>' +
+      '<td>' + actionHtml + '</td>' +
       '</tr>';
   }
 
@@ -1360,8 +1380,10 @@ export const agentsConfigPageHtml = `<!doctype html>
           // has to be installed separately, or the tool fails at runtime
           // with an opaque "Cannot find package" the very next time this
           // agent's config is loaded. Surfaced here, loudly, instead of
-          // leaving that as a silent trap discovered later.
-          message += ' <strong>This ability also needs: <code>npm install ' + escapeHtml(deps.join(' ')) + '</code></strong> in your own project before it will actually work.';
+          // leaving that as a silent trap discovered later — the
+          // Installed table below now has its own "Install deps" button
+          // for exactly this (see handleAbilityInstallDepsPost).
+          message += ' <strong>This ability also needs: <code>' + escapeHtml(deps.join(', ')) + '</code></strong> — use the "Install deps" button below, or run <code>npm install ' + escapeHtml(deps.join(' ')) + '</code> yourself.';
         }
         statusEl.innerHTML = message;
         loadAbilitiesTab(name);
@@ -1415,12 +1437,45 @@ export const agentsConfigPageHtml = `<!doctype html>
       });
   }
 
+  // Runs npm install for an ability's own missing dependencies
+  // (handleAbilityInstallDepsPost) — the server reads the dependency
+  // list back off this ability's own installed record, not anything
+  // this form could tamper with, so there's nothing to pass except
+  // which ability. Can take a while (a native module like sharp
+  // especially), so the button stays disabled and the status line says
+  // so rather than looking hung.
+  function installAbilityDeps(name, abilityName, statusEl, btn) {
+    if (btn) { btn.disabled = true; }
+    statusEl.className = 'hint';
+    statusEl.textContent = 'Running npm install for ' + abilityName + '’s dependencies… this can take a minute.';
+    fetch('/agents/' + encodeURIComponent(name) + '/abilities/' + encodeURIComponent(abilityName) + '/install-deps', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({}),
+    })
+      .then(function (r) { return r.json().then(function (j) { return { ok: r.ok, body: j }; }); })
+      .then(function (result) {
+        if (!result.ok) throw new Error(result.body.error || 'request failed');
+        var installed = result.body.installed || [];
+        statusEl.className = 'hint';
+        statusEl.textContent = installed.length
+          ? 'Installed: ' + installed.join(', ') + '. Restart the server to pick it up.'
+          : abilityName + ' had no dependencies to install.';
+        loadAbilitiesTab(name);
+      })
+      .catch(function (err) {
+        statusEl.className = 'error';
+        statusEl.textContent = 'Could not install dependencies: ' + err.message;
+        if (btn) { btn.disabled = false; }
+      });
+  }
+
   // Shared by the initial (empty-query) load right after the tab opens
   // and the search form's own submit — the empty-query case is just
   // "list every published ability" (the keyword filter alone, no extra
   // search text), so an operator sees what's out there immediately
   // instead of having to search for something before anything shows up.
-  function runAbilitySearch(name, q, content, resultsEl) {
+  function runAbilitySearch(name, q, content, resultsEl, installedNames) {
     resultsEl.innerHTML = '<p class="hint">Loading&hellip;</p>';
     fetch('/agents/' + encodeURIComponent(name) + '/abilities/search' + (q ? '?q=' + encodeURIComponent(q) : ''))
       .then(function (r) { return r.json().then(function (j) { return { ok: r.ok, body: j }; }); })
@@ -1428,7 +1483,7 @@ export const agentsConfigPageHtml = `<!doctype html>
         if (!result.ok) throw new Error(result.body.error || 'search failed');
         var results = result.body.results || [];
         resultsEl.innerHTML = results.length
-          ? '<table><thead><tr><th>Package</th><th>Description</th><th></th></tr></thead><tbody>' + results.map(renderAbilitySearchResultRow).join('') + '</tbody></table>'
+          ? '<table><thead><tr><th>Package</th><th>Description</th><th></th></tr></thead><tbody>' + results.map(function (pkg) { return renderAbilitySearchResultRow(pkg, installedNames); }).join('') + '</tbody></table>'
           : '<p class="hint">No public abilities found.</p>';
         var installBtns = resultsEl.querySelectorAll('.ability-install-btn');
         for (var i = 0; i < installBtns.length; i++) {
@@ -1443,7 +1498,7 @@ export const agentsConfigPageHtml = `<!doctype html>
       });
   }
 
-  function wireAbilitiesHandlers(name) {
+  function wireAbilitiesHandlers(name, installedNames) {
     var content = abilitiesContentEl();
     if (!content) return;
 
@@ -1456,17 +1511,25 @@ export const agentsConfigPageHtml = `<!doctype html>
       });
     }
 
+    var installDepsBtns = content.querySelectorAll('.ability-install-deps-btn');
+    for (var d = 0; d < installDepsBtns.length; d++) {
+      installDepsBtns[d].addEventListener('click', function (ev) {
+        var btn = ev.currentTarget;
+        installAbilityDeps(name, btn.dataset.name, upgradeStatusEl, btn);
+      });
+    }
+
     var searchForm = content.querySelector('#abilitySearchForm');
     var resultsEl = content.querySelector('#abilitySearchResults');
     if (searchForm && resultsEl) {
       searchForm.addEventListener('submit', function (ev) {
         ev.preventDefault();
         var q = new FormData(searchForm).get('q');
-        runAbilitySearch(name, q, content, resultsEl);
+        runAbilitySearch(name, q, content, resultsEl, installedNames);
       });
       // List every published ability immediately, not just after the
       // operator explicitly searches for something.
-      runAbilitySearch(name, '', content, resultsEl);
+      runAbilitySearch(name, '', content, resultsEl, installedNames);
     }
 
     var installForm = content.querySelector('#abilityInstallForm');
@@ -1485,7 +1548,8 @@ export const agentsConfigPageHtml = `<!doctype html>
     var content = abilitiesContentEl();
     if (!content) return;
     content.innerHTML = renderAbilitiesConfigHtml(data);
-    wireAbilitiesHandlers(name);
+    var installedNames = (data.abilities || []).map(function (a) { return a.name; });
+    wireAbilitiesHandlers(name, installedNames);
     abilitiesLoadedFor = name;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loopengine",
-  "version": "0.1.39",
+  "version": "0.1.42",
   "type": "module",
   "description": "Runtime for tool-using AI agents with a transparent ReAct loop.",
   "license": "MIT",