loopengine 0.1.4 → 0.1.6

package/PROTOCOL.md

@@ -190,7 +190,7 @@ loopengine run customer-service --json "order A-1001 arrived broken, can you ref
 
 ```
 {"type":"session","sessionId":"5a83c6b4-..."}
-{"type":"budget:check","action":"ok","usedTokens":2,"budgetTokens":8000,"ratio":0.00025}
+{"type":"budget:check","action":"ok","usedTokens":2,"budgetTokens":100000,"ratio":0.00002}
 {"type":"tool:started","id":"call_1","tool":"issue_refund", ...}
 {"type":"done","text":"Refunded $42.00..."}
 ```

package/dist/core/run-agent.js

@@ -310,7 +310,12 @@ async function buildTurnContext(config, modelCall, options) {
     // that doesn't exist (a flat-file agent with no skills at all)
     // harmless: an empty index, not an error.
     const skillsDirs = config.skillsDirs ?? [`agents/${config.name}/skills`];
-    const skillGarden = new SkillGarden({ dirs: [...skillsDirs, systemSkillsDir], indexBudgetTokens: config.skillIndexBudgetTokens ?? 200 });
+    // 2000, not an arbitrary round number: skillgarden's own default is
+    // ~1% of a real agent context window (~100k-200k tokens for the
+    // providers this repo wires up) — see its own SkillGardenOptions doc
+    // comment. loopengine used to default lower (200), which left barely
+    // enough room for a handful of skills before truncating the index.
+    const skillGarden = new SkillGarden({ dirs: [...skillsDirs, systemSkillsDir], indexBudgetTokens: config.skillIndexBudgetTokens ?? 2000 });
     const skillIndex = skillGarden.buildIndex().included;
     // Also the tail-preservation window recover() below relies on — kept as
     // one named constant so the two can never drift out of sync.
@@ -321,8 +326,17 @@ async function buildTurnContext(config, modelCall, options) {
     // budgetTokens/softThreshold so a nudge firing and compaction's own
     // recovery target agree — see budget.ts's own BudgetTrackerOptions doc
     // comment.
-    const budgetTracker = new BudgetTracker({ budgetTokens: config.contextBudgetTokens ?? 8000 });
-    const compactor = new Compactor({ budgetTokens: config.contextBudgetTokens ?? 8000, softThreshold: budgetTracker.softThreshold, tailMessages });
+    // 100000, not 8000: the providers this repo wires up (Claude, GPT-4o,
+    // DeepSeek) all give a real conversation 128k-200k tokens of window,
+    // and 8000 was small enough that a handful of tool calls (each with a
+    // full JSON schema + result) routinely tripped compaction on an
+    // otherwise ordinary turn. 100000 leaves headroom under even the
+    // smallest of those windows for the system prompt, tool schemas, and
+    // the model's own response, while softThreshold's default 0.7 (a
+    // 70000-token nudge point) and hardThreshold's 0.92 still leave real
+    // margin before hitting it.
+    const budgetTracker = new BudgetTracker({ budgetTokens: config.contextBudgetTokens ?? 100000 });
+    const compactor = new Compactor({ budgetTokens: config.contextBudgetTokens ?? 100000, softThreshold: budgetTracker.softThreshold, tailMessages });
     const rules = loadRules(config);
     // AgentConfig.httpNotifier only ever stands in for the http channel —
     // see its own doc comment for why cli/http_stream never consult it at

package/dist/index.d.ts

@@ -27,12 +27,16 @@ export { listQuestions, answerQuestion as resolvePendingQuestion, findQuestion,
 export type { PendingQuestion } from './core/system-tools/index.js';
 export { editAgentFile, AgentEditNotSupportedError, AgentFileNotFoundError } from './web/agent-file-admin.js';
 export type { AgentEditableFields, AgentEditResult } from './web/agent-file-admin.js';
+export { createHttpTool, HttpToolNameError, HttpToolExistsError, HttpToolIndexShapeError } from './web/http-tool-admin.js';
+export type { HttpToolSpec, HttpToolField } from './web/http-tool-admin.js';
 export { agentsConfigPageHtml } from './web/agents-config-page.js';
 export { agentsListPageHtml } from './web/agents-list-page.js';
 export { globalConfigPageHtml } from './web/global-config-page.js';
 export { playgroundHtml } from './web/playground.js';
 export { readSkill, writeSkill, deleteSkill, SkillInvalidIdError, SkillNotFoundError } from './web/skills-admin.js';
 export type { SkillContent } from './web/skills-admin.js';
+export { listSkillgardenCatalog, readSkillgardenCatalogEntry, addSkillgardenSkillToAgent, SkillgardenUnavailableError } from './web/skillgarden-admin.js';
+export type { SkillgardenCatalogEntry, SkillgardenCatalogDetail } from './web/skillgarden-admin.js';
 export { readActauthConfig, addActauthRule, updateActauthRule, removeActauthRule, setDefaultDecision, ActauthRuleExistsError, ActauthRuleNotFoundError, } from './web/actauth-admin.js';
 export type { ActauthRuleInput, ActauthConfigView } from './web/actauth-admin.js';
 export { describeModelProviders, describeGateways } from './web/global-config.js';

package/dist/index.js

@@ -34,11 +34,13 @@ export { WebhookNotifier } from './core/http-notify-triggers/webhook.js';
 // question in-process, aliased to avoid colliding with that name.
 export { listQuestions, answerQuestion as resolvePendingQuestion, findQuestion, createAskUserTool } from './core/system-tools/index.js';
 export { editAgentFile, AgentEditNotSupportedError, AgentFileNotFoundError } from './web/agent-file-admin.js';
+export { createHttpTool, HttpToolNameError, HttpToolExistsError, HttpToolIndexShapeError } from './web/http-tool-admin.js';
 export { agentsConfigPageHtml } from './web/agents-config-page.js';
 export { agentsListPageHtml } from './web/agents-list-page.js';
 export { globalConfigPageHtml } from './web/global-config-page.js';
 export { playgroundHtml } from './web/playground.js';
 export { readSkill, writeSkill, deleteSkill, SkillInvalidIdError, SkillNotFoundError } from './web/skills-admin.js';
+export { listSkillgardenCatalog, readSkillgardenCatalogEntry, addSkillgardenSkillToAgent, SkillgardenUnavailableError } from './web/skillgarden-admin.js';
 export { readActauthConfig, addActauthRule, updateActauthRule, removeActauthRule, setDefaultDecision, ActauthRuleExistsError, ActauthRuleNotFoundError, } from './web/actauth-admin.js';
 export { describeModelProviders, describeGateways } from './web/global-config.js';
 export { createTrackedApprover, listApprovals, decideApproval, findApproval } from './web/web-approver.js';

package/dist/web/agent-file-admin.d.ts

@@ -9,6 +9,9 @@ export interface AgentEditableFields {
         provider: Provider;
         model?: string;
     };
+    maxTurns?: number;
+    contextBudgetTokens?: number;
+    skillIndexBudgetTokens?: number;
 }
 export interface AgentEditResult {
     systemPrompt?: string;
@@ -16,6 +19,9 @@ export interface AgentEditResult {
         provider: Provider;
         model: string;
     };
+    maxTurns?: number;
+    contextBudgetTokens?: number;
+    skillIndexBudgetTokens?: number;
 }
 /** Surgically rewrites just the fields given in `fields` — see this
  * file's own header comment for why, and for the "refuse rather than

package/dist/web/agent-file-admin.js

@@ -89,6 +89,31 @@ function findConfigObjectLiteral(sourceFile) {
 function findProperty(obj, name) {
     return obj.properties.find((p) => p.name !== undefined && ts.isIdentifier(p.name) && p.name.text === name);
 }
+// maxTurns/contextBudgetTokens/skillIndexBudgetTokens are the only three
+// AgentConfig fields this file edits that are *usually absent* — every
+// agent in this repo, and create-loopengine's own scaffold template,
+// leaves all three unset and rides run-agent.ts's own defaults (25 /
+// 100000 / 2000), unlike systemPrompt/model which agentIndexTemplate always
+// writes out explicitly. So "the property isn't in this file" can't mean
+// refuse here the way it does for a genuinely unusual systemPrompt/model
+// shape — that would make every freshly scaffolded agent's limits
+// permanently uneditable through this API. Missing properties are
+// collected into `toInsert` instead and spliced in as new lines just
+// before the object literal's closing brace (see editAgentFile's own use
+// of this); an *existing* property whose value isn't a plain number
+// literal is still refused, same "don't guess" rule as everything else
+// in this file.
+function upsertNumericProperty(configObj, sourceFile, edits, toInsert, name, value) {
+    const prop = findProperty(configObj, name);
+    if (!prop) {
+        toInsert.push(`${name}: ${value}`);
+        return;
+    }
+    if (!ts.isPropertyAssignment(prop) || !ts.isNumericLiteral(prop.initializer)) {
+        throw new AgentEditNotSupportedError(`${name} in this file is not a plain number literal — edit it directly.`);
+    }
+    edits.push({ start: prop.initializer.getStart(sourceFile), end: prop.initializer.getEnd(), text: String(value) });
+}
 /** Surgically rewrites just the fields given in `fields` — see this
  * file's own header comment for why, and for the "refuse rather than
  * guess" rule this follows for anything that isn't a plain, recognizable
@@ -150,6 +175,31 @@ export function editAgentFile(agentName, fields) {
             edits.push({ start: comment.pos, end: comment.end, text: `// reads ${MODEL_ENV_VAR[provider]}` });
         }
     }
+    const toInsert = [];
+    for (const name of ['maxTurns', 'contextBudgetTokens', 'skillIndexBudgetTokens']) {
+        const value = fields[name];
+        if (value === undefined)
+            continue;
+        if (!Number.isInteger(value) || value < 1) {
+            throw new AgentEditNotSupportedError(`${name} must be a positive integer.`);
+        }
+        upsertNumericProperty(configObj, sourceFile, edits, toInsert, name, value);
+        result[name] = value;
+    }
+    if (toInsert.length) {
+        // Insert right before the closing "}", not right after the last
+        // property node — a hand-written trailing line comment there (like
+        // model's own "// reads ANTHROPIC_API_KEY" above) would otherwise end
+        // up with new properties spliced into the middle of it. The object's
+        // own pre-existing newline-before-"}" becomes the separator before
+        // the first inserted line for free; only an object with *no*
+        // properties at all needs its own leading newline.
+        const closeBracePos = configObj.getEnd() - 1;
+        const hasProps = configObj.properties.length > 0;
+        const needsLeadingComma = hasProps && !configObj.properties.hasTrailingComma;
+        const text = (hasProps ? '' : '\n') + (needsLeadingComma ? ',' : '') + toInsert.map((p) => `  ${p},\n`).join('');
+        edits.push({ start: closeBracePos, end: closeBracePos, text });
+    }
     if (!edits.length)
         return result;
     // Apply from the end of the file backward — each edit's start/end was

package/dist/web/agents-config-page.js

@@ -131,6 +131,18 @@ export const agentsConfigPageHtml = `<!doctype html>
     letter-spacing: normal;
     padding: 2px 8px;
   }
+  .admin-subsection {
+    margin-top: 14px;
+    padding-top: 14px;
+    border-top: 1px dashed light-dark(#eee, #2a2a2e);
+  }
+  .admin-subsection h4 {
+    font-size: 12px;
+    text-transform: uppercase;
+    letter-spacing: 0.04em;
+    color: light-dark(#666, #999);
+    margin: 0 0 8px;
+  }
   pre {
     background: light-dark(#fff, #26262b);
     border: 1px solid light-dark(#ddd, #3a3a3e);
@@ -297,6 +309,84 @@ export const agentsConfigPageHtml = `<!doctype html>
      stretches the checkbox to the full row width, which visually
      overlaps the description text under it instead of sitting beside it. */
   form.add-source input[type="checkbox"] { width: auto; flex-shrink: 0; margin-top: 2px; }
+  /* Same column-stacking issue as .tool-picker-item above: .http-tool-
+     inline-label (the "required" / "send as JSON body" checkboxes in the
+     HTTP tool builder) is a <label> too, so "form.add-source label" wins
+     on specificity alone and stacks the checkbox above its own text
+     instead of beside it — this rule needs to match "label" too to win. */
+  form.add-source label.http-tool-inline-label {
+    display: flex;
+    flex-direction: row;
+    align-items: center;
+    gap: 6px;
+  }
+  /* These three are plain <div>s of sibling inputs/selects/buttons, not
+     <label>s, so none of the rules above touch them — without an explicit
+     row layout they just wrap at the browser's default inline spacing,
+     which reads as everything jammed together with no breathing room.
+     form.add-source itself caps at max-width: 480px (see above), which
+     isn't wide enough to hold a field row's 5 items (name/type/
+     description/required/delete) on one line at a readable width, so
+     this wraps rather than forcing a single cramped line — each item
+     gets a min-width so text inputs wrap onto their own line instead of
+     shrinking to an unreadable sliver. */
+  .http-tool-field-row, .http-tool-header-row, .http-tool-method-url {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: center;
+    gap: 8px;
+    margin-bottom: 8px;
+  }
+  /* Same "form.add-source input { width: 100% }" override as the checkbox
+     fix above — each field here sits beside its siblings in a row, not
+     stacked full-width above them. */
+  .http-tool-field-row input[type="text"],
+  .http-tool-field-row select,
+  .http-tool-header-row input[type="text"],
+  .http-tool-method-url input[type="text"],
+  .http-tool-method-url select {
+    width: auto;
+  }
+  .http-tool-field-row .http-tool-field-name { flex: 1 1 100px; min-width: 100px; }
+  .http-tool-field-row .http-tool-field-type { flex: 0 0 auto; }
+  .http-tool-field-row .http-tool-field-description { flex: 2 1 140px; min-width: 140px; }
+  .http-tool-field-row .http-tool-inline-label { flex: 0 0 auto; white-space: nowrap; }
+  .http-tool-header-row .http-tool-header-key { flex: 1 1 100px; min-width: 100px; }
+  .http-tool-header-row .http-tool-header-value { flex: 2 1 140px; min-width: 140px; }
+  .http-tool-method-url select { flex: 0 0 auto; }
+  .http-tool-method-url input[type="text"] { flex: 1 1 160px; min-width: 160px; }
+  .http-tool-field-row .http-tool-remove-row,
+  .http-tool-header-row .http-tool-remove-row {
+    flex: 0 0 auto;
+    margin-left: auto;
+  }
+  /* Taller than .hint-btn's own 2px 8px default (shared with the Gateway
+     Tools "Refresh" button, which sits inline in an <h3> and shouldn't
+     grow) — these two sit on their own line below the field/header rows,
+     so there's no header-row height to match. */
+  #httpToolAddFieldBtn, #httpToolAddHeaderBtn {
+    padding: 6px 12px;
+  }
+  .skillgarden-category-badge {
+    display: inline-block;
+    font-family: ui-sans-serif, system-ui, sans-serif;
+    font-size: 10px;
+    font-weight: 600;
+    text-transform: uppercase;
+    letter-spacing: 0.03em;
+    padding: 1px 7px;
+    border-radius: 999px;
+    background: light-dark(#eef1ec, #1e2519);
+    color: light-dark(#3f6b4a, #7fbf8f);
+    margin-right: 6px;
+  }
+  #skillgardenFilterInput { margin-bottom: 8px; }
+  .skillgarden-catalog-body {
+    margin-top: 8px;
+    padding-top: 8px;
+    border-top: 1px solid light-dark(#eee, #2a2a2e);
+    font-size: 13px;
+  }
 </style>
 </head>
 <body>
@@ -587,15 +677,31 @@ export const agentsConfigPageHtml = `<!doctype html>
         '<dt>tenantFor</dt><dd>' + badge(cfg.tenantFor.indexOf('custom') === 0 ? 'custom' : 'default') + ' <span class="muted">' + escapeHtml(cfg.tenantFor) + '</span></dd>' +
         '<dt>isSafeTool</dt><dd>' + badge(cfg.isSafeTool === 'custom' ? 'custom' : 'default') + ' <span class="muted">' + escapeHtml(cfg.isSafeTool) + '</span></dd>' +
         '</dl></section>' +
-      '<section><h3>Limits &amp; budgets</h3><dl class="kv">' +
-        '<dt>maxTurns</dt><dd>' + escapeHtml(cfg.maxTurns) + '</dd>' +
-        '<dt>contextBudgetTokens</dt><dd>' + escapeHtml(cfg.contextBudgetTokens) + '</dd>' +
-        '<dt>skillIndexBudgetTokens</dt><dd>' + escapeHtml(cfg.skillIndexBudgetTokens) + '</dd>' +
-        '<dt>skillsDirs</dt><dd>' + escapeHtml(cfg.skillsDirs.join(', ') || '(none)') + '</dd>' +
-        '</dl></section>';
+      '<section><h3>Limits &amp; budgets <button type="button" class="edit-btn" id="editLimitsBtn">Edit</button></h3>' +
+        '<dl class="kv" id="limitsDisplay">' +
+          '<dt>maxTurns</dt><dd>' + escapeHtml(cfg.maxTurns) + '</dd>' +
+          '<dt>contextBudgetTokens</dt><dd>' + escapeHtml(cfg.contextBudgetTokens) + '</dd>' +
+          '<dt>skillIndexBudgetTokens</dt><dd>' + escapeHtml(cfg.skillIndexBudgetTokens) + '</dd>' +
+        '</dl>' +
+        '<form class="add-source" id="limitsForm" style="display:none">' +
+          '<label>Max turns <span class="hint">(hard cap on model calls in one turn)</span>' +
+            '<input type="number" name="maxTurns" min="1" step="1" value="' + escapeHtml(cfg.maxTurns) + '">' +
+          '</label>' +
+          '<label>Context budget <span class="hint">(tokens — triggers compaction of older messages once exceeded)</span>' +
+            '<input type="number" name="contextBudgetTokens" min="1" step="1" value="' + escapeHtml(cfg.contextBudgetTokens) + '">' +
+          '</label>' +
+          '<label>Skill index budget <span class="hint">(tokens — caps the always-loaded skill name/description index)</span>' +
+            '<input type="number" name="skillIndexBudgetTokens" min="1" step="1" value="' + escapeHtml(cfg.skillIndexBudgetTokens) + '">' +
+          '</label>' +
+          '<button type="submit">Save</button>' +
+          '<button type="button" id="cancelLimitsBtn">Cancel</button>' +
+          '<div class="error" id="limitsError"></div>' +
+        '</form>' +
+        '<dl class="kv"><dt>skillsDirs</dt><dd>' + escapeHtml(cfg.skillsDirs.join(', ') || '(none)') + '</dd></dl>' +
+      '</section>';
   }
 
-  // Wires the System prompt / Model Edit buttons rendered by
+  // Wires the System prompt / Model / Limits & budgets Edit buttons rendered by
   // renderOverviewHtml above — called every time that HTML gets (re)set
   // (renderDetail, refreshOverviewPanel, refreshSkillsDependentPanels),
   // same pattern every other tab's own wireXHandlers already follows.
@@ -696,6 +802,53 @@ export const agentsConfigPageHtml = `<!doctype html>
           });
       });
     }
+
+    var editLimitsBtn = overviewPanel.querySelector('#editLimitsBtn');
+    if (editLimitsBtn) {
+      var limitsDisplay = overviewPanel.querySelector('#limitsDisplay');
+      var limitsForm = overviewPanel.querySelector('#limitsForm');
+      var limitsError = overviewPanel.querySelector('#limitsError');
+
+      editLimitsBtn.addEventListener('click', function () {
+        limitsDisplay.style.display = 'none';
+        editLimitsBtn.style.display = 'none';
+        limitsForm.style.display = '';
+      });
+      overviewPanel.querySelector('#cancelLimitsBtn').addEventListener('click', function () {
+        limitsForm.style.display = 'none';
+        limitsDisplay.style.display = '';
+        editLimitsBtn.style.display = '';
+        limitsError.textContent = '';
+      });
+      limitsForm.addEventListener('submit', function (ev) {
+        ev.preventDefault();
+        limitsError.textContent = '';
+        var data = new FormData(limitsForm);
+        var submitBtn = limitsForm.querySelector('button[type="submit"]');
+        submitBtn.disabled = true;
+        var body = {
+          maxTurns: Number(data.get('maxTurns')),
+          contextBudgetTokens: Number(data.get('contextBudgetTokens')),
+          skillIndexBudgetTokens: Number(data.get('skillIndexBudgetTokens')),
+        };
+        fetch('/agents/' + encodeURIComponent(name), {
+          method: 'PUT',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify(body),
+        })
+          .then(function (r) { return r.json().then(function (j) { return { ok: r.ok, body: j }; }); })
+          .then(function (result) {
+            if (!result.ok) throw new Error(result.body.error || 'request failed');
+            currentCfg = result.body;
+            overviewPanel.innerHTML = renderOverviewHtml(result.body);
+            wireOverviewHandlers(name);
+          })
+          .catch(function (err) {
+            limitsError.textContent = err.message;
+            submitBtn.disabled = false;
+          });
+      });
+    }
   }
 
   // ---- Overview's own Actauth section: read-only, from cfg.permissions
@@ -1004,18 +1157,194 @@ export const agentsConfigPageHtml = `<!doctype html>
           '<button type="submit" id="skillSubmitBtn">Add</button>' +
           '<button type="button" id="skillCancelBtn" style="display:none">Cancel</button>' +
           '<div id="skillFormError" class="error"></div>' +
-        '</form></section>';
+        '</form></section>' +
+      '<section><h3>Browse skillgarden catalog</h3>' +
+        '<input type="text" id="skillgardenFilterInput" placeholder="Filter by name or category&hellip;">' +
+        '<div id="skillgardenCatalogList"><p class="hint">Loading&hellip;</p></div>' +
+      '</section>';
   }
 
   function skillsPanelEl() {
     return detail.querySelector('[data-tab-panel="skills"]');
   }
 
+  // ---- Skills tab's "Browse skillgarden catalog" section: a
+  // read-only, agent-independent list of everything GET /skillgarden-
+  // catalog reports (see web/skillgarden-admin.ts) — cached in this one
+  // module-level variable, not per-agent like gatewayLoadedFor, since
+  // the catalog itself never varies by agent. renderSkillsTabHtml
+  // regenerates the whole Skills panel (including this section's own
+  // markup) on every agent switch/refresh, so loadSkillgardenCatalogSection
+  // re-renders from this cache instead of re-fetching every time — only
+  // the very first time this tab is opened in the page's lifetime hits
+  // the network at all. ----
+  var skillgardenCatalog = null;
+
+  function skillgardenCatalogListEl() {
+    var panel = skillsPanelEl();
+    return panel ? panel.querySelector('#skillgardenCatalogList') : null;
+  }
+
+  function renderSkillgardenCatalogEntry(entry) {
+    return '<div class="source" data-category="' + escapeHtml(entry.category) + '" data-id="' + escapeHtml(entry.id) + '">' +
+      '<div class="source-head">' +
+        '<h4><span class="skillgarden-category-badge">' + escapeHtml(entry.category) + '</span>' + escapeHtml(entry.id) + '</h4>' +
+        '<span>' +
+          '<button type="button" class="skillgarden-view-btn" data-category="' + escapeHtml(entry.category) + '" data-id="' + escapeHtml(entry.id) + '">View</button> ' +
+          '<button type="button" class="skillgarden-add-btn" data-category="' + escapeHtml(entry.category) + '" data-id="' + escapeHtml(entry.id) + '">Add to this agent</button>' +
+        '</span>' +
+      '</div>' +
+      '<p class="hint">' + escapeHtml(entry.description) + '</p>' +
+      '<div class="skillgarden-catalog-body" style="display:none"></div>' +
+      '</div>';
+  }
+
+  function renderSkillgardenCatalogList(entries) {
+    return entries.length ? entries.map(renderSkillgardenCatalogEntry).join('') : '<p class="hint">No skills match.</p>';
+  }
+
+  function applySkillgardenCatalog(name, entries) {
+    var listEl = skillgardenCatalogListEl();
+    if (!listEl) return;
+    listEl.innerHTML = renderSkillgardenCatalogList(entries);
+    wireSkillgardenCatalogHandlers(name);
+  }
+
+  function filteredSkillgardenCatalog(filterText) {
+    if (!filterText) return skillgardenCatalog;
+    var needle = filterText.toLowerCase();
+    return skillgardenCatalog.filter(function (entry) {
+      return entry.category.toLowerCase().indexOf(needle) !== -1 || entry.id.toLowerCase().indexOf(needle) !== -1;
+    });
+  }
+
+  function loadSkillgardenCatalogSection(name) {
+    var listEl = skillgardenCatalogListEl();
+    if (!listEl) return;
+    if (skillgardenCatalog) {
+      var panel = skillsPanelEl();
+      var filterInput = panel ? panel.querySelector('#skillgardenFilterInput') : null;
+      applySkillgardenCatalog(name, filteredSkillgardenCatalog(filterInput ? filterInput.value.trim() : ''));
+      return;
+    }
+    listEl.innerHTML = '<p class="hint">Loading&hellip;</p>';
+    fetch('/skillgarden-catalog')
+      .then(function (r) { return r.json().then(function (j) { return { ok: r.ok, body: j }; }); })
+      .then(function (result) {
+        if (!result.ok) throw new Error(result.body.error || 'request failed');
+        skillgardenCatalog = result.body;
+        if (currentName !== name) return;
+        applySkillgardenCatalog(name, skillgardenCatalog);
+      })
+      .catch(function (err) {
+        if (currentName !== name) return;
+        listEl.innerHTML = '<p class="error">Could not load skillgarden catalog: ' + escapeHtml(err.message) + '</p>';
+      });
+  }
+
+  // force=true retries as an explicit overwrite after the operator
+  // confirms — same "ask once a plain add collides, don't ask up front"
+  // flow the rest of this page never has to think about since nothing
+  // else lets an operator add something whose id they don't already
+  // control the uniqueness of themselves.
+  function performSkillgardenAdd(name, category, id, btn, originalText, force) {
+    fetch('/agents/' + encodeURIComponent(name) + '/skillgarden-catalog/' + encodeURIComponent(category) + '/' + encodeURIComponent(id), {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ force: !!force }),
+    })
+      .then(function (r) { return r.json().then(function (j) { return { ok: r.ok, body: j }; }); })
+      .then(function (result) {
+        if (result.ok) {
+          refreshSkillsDependentPanels(name);
+          return;
+        }
+        if (!force && /already exists/.test(result.body.error || '')) {
+          if (confirm('A skill named "' + id + '" already exists for this agent. Overwrite it?')) {
+            performSkillgardenAdd(name, category, id, btn, originalText, true);
+            return;
+          }
+          btn.disabled = false;
+          btn.textContent = originalText;
+          return;
+        }
+        throw new Error(result.body.error || 'request failed');
+      })
+      .catch(function (err) {
+        alert('Could not add "' + id + '": ' + err.message);
+        btn.disabled = false;
+        btn.textContent = originalText;
+      });
+  }
+
+  function wireSkillgardenCatalogHandlers(name) {
+    var listEl = skillgardenCatalogListEl();
+    if (!listEl) return;
+
+    var viewButtons = listEl.querySelectorAll('.skillgarden-view-btn');
+    for (var i = 0; i < viewButtons.length; i++) {
+      viewButtons[i].addEventListener('click', function (ev) {
+        var btn = ev.currentTarget;
+        var category = btn.getAttribute('data-category');
+        var id = btn.getAttribute('data-id');
+        var card = btn.closest('.source');
+        var bodyEl = card.querySelector('.skillgarden-catalog-body');
+        if (bodyEl.style.display !== 'none') {
+          bodyEl.style.display = 'none';
+          btn.textContent = 'View';
+          return;
+        }
+        if (bodyEl.getAttribute('data-loaded') === '1') {
+          bodyEl.style.display = 'block';
+          btn.textContent = 'Hide';
+          return;
+        }
+        btn.disabled = true;
+        fetch('/skillgarden-catalog/' + encodeURIComponent(category) + '/' + encodeURIComponent(id))
+          .then(function (r) { return r.json().then(function (j) { return { ok: r.ok, body: j }; }); })
+          .then(function (result) {
+            if (!result.ok) throw new Error(result.body.error || 'request failed');
+            bodyEl.innerHTML = renderMarkdownPreview(result.body.body);
+            bodyEl.setAttribute('data-loaded', '1');
+            bodyEl.style.display = 'block';
+            btn.textContent = 'Hide';
+          })
+          .catch(function (err) {
+            bodyEl.innerHTML = '<p class="error">' + escapeHtml(err.message) + '</p>';
+            bodyEl.style.display = 'block';
+          })
+          .then(function () { btn.disabled = false; });
+      });
+    }
+
+    var addButtons = listEl.querySelectorAll('.skillgarden-add-btn');
+    for (var j = 0; j < addButtons.length; j++) {
+      addButtons[j].addEventListener('click', function (ev) {
+        var btn = ev.currentTarget;
+        var category = btn.getAttribute('data-category');
+        var id = btn.getAttribute('data-id');
+        var originalText = btn.textContent;
+        btn.disabled = true;
+        btn.textContent = 'Adding…';
+        performSkillgardenAdd(name, category, id, btn, originalText, false);
+      });
+    }
+  }
+
   function wireSkillsHandlers(name) {
     var panel = skillsPanelEl();
     if (!panel) return;
     var editingSkillId = null;
 
+    loadSkillgardenCatalogSection(name);
+    var skillgardenFilterInput = panel.querySelector('#skillgardenFilterInput');
+    if (skillgardenFilterInput) {
+      skillgardenFilterInput.addEventListener('input', function () {
+        if (!skillgardenCatalog) return;
+        applySkillgardenCatalog(name, filteredSkillgardenCatalog(skillgardenFilterInput.value.trim()));
+      });
+    }
+
     // Write/Preview toggle for the Body field — same idea as GitHub's own
     // issue/PR editor: the textarea and the rendered preview show/hide
     // each other, the textarea's value is the only source of truth (the
@@ -1145,7 +1474,9 @@ export const agentsConfigPageHtml = `<!doctype html>
   // describeGatewayTools), a real cost not worth paying up front. ----
 
   function renderToolsTabHtml(cfg) {
-    return '<section><h3>Local tools (' + cfg.localTools.length + ')</h3>' + renderTools(cfg.localTools) + '</section>' +
+    return '<section><h3>Local tools (' + cfg.localTools.length + ')</h3>' + renderTools(cfg.localTools) +
+      '<div class="admin-subsection"><h4>Create an HTTP tool</h4>' + renderHttpToolFormHtml() + '</div>' +
+      '</section>' +
       '<section id="gatewayToolsSection">' +
         '<h3>Gateway Tools <button type="button" id="gatewayToolsRefreshBtn" class="hint-btn">Refresh</button></h3>' +
         '<div id="gatewayToolsContent"><p class="hint">Loading&hellip;</p></div>' +
@@ -1153,6 +1484,170 @@ export const agentsConfigPageHtml = `<!doctype html>
       '<section><h3>Agent as Tools (' + cfg.agentAsTools.length + ')</h3>' + renderTools(cfg.agentAsTools) + '</section>';
   }
 
+  // ---- Create an HTTP tool: generates a real agents/:name/tools/<tool>.ts
+  // file from this form (loopengine's own createHttpTool), never arbitrary
+  // code — only one shape, a parameterized HTTP call. See
+  // web/http-tool-admin.ts's own header comment for why this is the line
+  // this repo draws instead of, say, storing code in a SKILL.md and
+  // executing it at request time. ----
+
+  var httpToolFieldRowCount = 0;
+  var httpToolHeaderRowCount = 0;
+
+  function renderHttpToolFieldRow(index) {
+    return '<div class="http-tool-field-row" data-row="' + index + '">' +
+      '<input type="text" class="http-tool-field-name" placeholder="field_name" pattern="[a-zA-Z_][a-zA-Z0-9_]*">' +
+      '<select class="http-tool-field-type">' +
+        '<option value="string">string</option>' +
+        '<option value="number">number</option>' +
+        '<option value="boolean">boolean</option>' +
+      '</select>' +
+      '<input type="text" class="http-tool-field-description" placeholder="description (optional)">' +
+      '<label class="http-tool-inline-label"><input type="checkbox" class="http-tool-field-required" checked> required</label>' +
+      '<button type="button" class="delete-btn http-tool-remove-row" title="Remove this field" aria-label="Remove this field">Delete</button>' +
+      '</div>';
+  }
+
+  function renderHttpToolHeaderRow(index) {
+    return '<div class="http-tool-header-row" data-row="' + index + '">' +
+      '<input type="text" class="http-tool-header-key" placeholder="Header-Name">' +
+      '<input type="text" class="http-tool-header-value" placeholder="value, {field}, or {{ENV_VAR}}">' +
+      '<button type="button" class="delete-btn http-tool-remove-row" title="Remove this header" aria-label="Remove this header">Delete</button>' +
+      '</div>';
+  }
+
+  function renderHttpToolFormHtml() {
+    httpToolFieldRowCount = 0;
+    httpToolHeaderRowCount = 0;
+    return '<form class="add-source" id="httpToolForm">' +
+      '<label>Name <span class="hint">(snake_case, e.g. lookup_order_status)</span>' +
+        '<input type="text" name="name" required pattern="[a-z][a-z0-9_]*" placeholder="lookup_order_status">' +
+      '</label>' +
+      '<label>Description' +
+        '<textarea name="description" id="httpToolDescriptionInput" required placeholder="What this tool does"></textarea>' +
+      '</label>' +
+      '<label>Fields' +
+        '<div id="httpToolFieldRows"></div>' +
+        '<button type="button" id="httpToolAddFieldBtn" class="hint-btn">Add field</button>' +
+      '</label>' +
+      '<label>Method &amp; URL <span class="hint">(use {field} for a field defined above)</span>' +
+        '<div class="http-tool-method-url">' +
+          '<select name="method">' +
+            '<option value="GET">GET</option>' +
+            '<option value="POST">POST</option>' +
+            '<option value="PUT">PUT</option>' +
+            '<option value="PATCH">PATCH</option>' +
+            '<option value="DELETE">DELETE</option>' +
+          '</select>' +
+          '<input type="text" name="url" required placeholder="https://api.example.com/orders/{orderId}">' +
+        '</div>' +
+      '</label>' +
+      '<label>Headers <span class="hint">(a value may reference {field} or {{ENV_VAR}} &mdash; never paste a real secret here)</span>' +
+        '<div id="httpToolHeaderRows"></div>' +
+        '<button type="button" id="httpToolAddHeaderBtn" class="hint-btn">Add header</button>' +
+      '</label>' +
+      '<label class="http-tool-inline-label"><input type="checkbox" name="sendFieldsAsJsonBody"> Send fields as a JSON body (POST/PUT/PATCH only)</label>' +
+      '<label>Response JSON path <span class="hint">(optional &mdash; e.g. data.status; leave blank to return the raw response text)</span>' +
+        '<input type="text" name="responseJsonPath" placeholder="data.status">' +
+      '</label>' +
+      '<label>Grant permission <span class="hint">(optional &mdash; leave blank to leave this tool at actauth&#39;s own default, typically deny)</span>' +
+        '<select name="decision">' +
+          '<option value="">(leave unset)</option>' +
+          '<option value="allow">allow</option>' +
+          '<option value="ask">ask</option>' +
+          '<option value="deny">deny</option>' +
+        '</select>' +
+      '</label>' +
+      '<button type="submit" id="httpToolSubmitBtn">Create tool</button>' +
+      '<div id="httpToolError" class="error"></div>' +
+      '</form>';
+  }
+
+  function wireHttpToolRemoveButton(row) {
+    var btn = row.querySelector('.http-tool-remove-row');
+    btn.addEventListener('click', function () {
+      row.parentNode.removeChild(row);
+    });
+  }
+
+  function wireHttpToolFormHandlers(name) {
+    var form = detail.querySelector('#httpToolForm');
+    if (!form) return;
+
+    var fieldRows = detail.querySelector('#httpToolFieldRows');
+    var headerRows = detail.querySelector('#httpToolHeaderRows');
+    var addFieldBtn = detail.querySelector('#httpToolAddFieldBtn');
+    var addHeaderBtn = detail.querySelector('#httpToolAddHeaderBtn');
+    var errorEl = detail.querySelector('#httpToolError');
+    var submitBtn = detail.querySelector('#httpToolSubmitBtn');
+
+    addFieldBtn.addEventListener('click', function () {
+      fieldRows.insertAdjacentHTML('beforeend', renderHttpToolFieldRow(httpToolFieldRowCount++));
+      wireHttpToolRemoveButton(fieldRows.lastElementChild);
+    });
+    addHeaderBtn.addEventListener('click', function () {
+      headerRows.insertAdjacentHTML('beforeend', renderHttpToolHeaderRow(httpToolHeaderRowCount++));
+      wireHttpToolRemoveButton(headerRows.lastElementChild);
+    });
+
+    form.addEventListener('submit', function (ev) {
+      ev.preventDefault();
+      errorEl.textContent = '';
+
+      var fields = [];
+      var fieldRowEls = fieldRows.querySelectorAll('.http-tool-field-row');
+      for (var i = 0; i < fieldRowEls.length; i++) {
+        var row = fieldRowEls[i];
+        var fieldName = row.querySelector('.http-tool-field-name').value.trim();
+        if (!fieldName) continue;
+        fields.push({
+          name: fieldName,
+          type: row.querySelector('.http-tool-field-type').value,
+          description: row.querySelector('.http-tool-field-description').value.trim() || undefined,
+          required: row.querySelector('.http-tool-field-required').checked,
+        });
+      }
+
+      var headers = [];
+      var headerRowEls = headerRows.querySelectorAll('.http-tool-header-row');
+      for (var j = 0; j < headerRowEls.length; j++) {
+        var hrow = headerRowEls[j];
+        var headerKey = hrow.querySelector('.http-tool-header-key').value.trim();
+        if (!headerKey) continue;
+        headers.push({ key: headerKey, value: hrow.querySelector('.http-tool-header-value').value });
+      }
+
+      var formData = new FormData(form);
+      var payload = {
+        name: formData.get('name'),
+        description: formData.get('description'),
+        fields: fields,
+        method: formData.get('method'),
+        url: formData.get('url'),
+        headers: headers,
+        sendFieldsAsJsonBody: formData.get('sendFieldsAsJsonBody') === 'on',
+        responseJsonPath: formData.get('responseJsonPath') ? formData.get('responseJsonPath') : undefined,
+        decision: formData.get('decision') ? formData.get('decision') : undefined,
+      };
+
+      submitBtn.disabled = true;
+      fetch('/agents/' + encodeURIComponent(name) + '/tools/http', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(payload),
+      })
+        .then(function (r) { return r.json().then(function (j) { return { ok: r.ok, body: j }; }); })
+        .then(function (result) {
+          if (!result.ok) throw new Error(result.body.error || 'request failed');
+          selectAgent(name);
+        })
+        .catch(function (err) {
+          errorEl.textContent = err.message;
+          submitBtn.disabled = false;
+        });
+    });
+  }
+
   // Removing a source used to be one "Remove" button per source, at the
   // bottom of the card — dropping every tool it produces at once, with
   // no way to remove just one. Each slug now gets its own remove icon
@@ -1565,6 +2060,7 @@ export const agentsConfigPageHtml = `<!doctype html>
 
     wireSkillsHandlers(cfg.name);
     wireOverviewHandlers(cfg.name);
+    wireHttpToolFormHandlers(cfg.name);
     var gatewayRefreshBtn = detail.querySelector('#gatewayToolsRefreshBtn');
     if (gatewayRefreshBtn) {
       gatewayRefreshBtn.addEventListener('click', function () { loadGatewayTab(cfg.name, true); });

package/dist/web/http-tool-admin.d.ts

@@ -0,0 +1,37 @@
+import type { ToolDefinition } from '../core/agent-config.js';
+export declare class HttpToolNameError extends Error {
+}
+export declare class HttpToolExistsError extends Error {
+}
+export declare class HttpToolIndexShapeError extends Error {
+}
+export interface HttpToolField {
+    name: string;
+    type: 'string' | 'number' | 'boolean';
+    description?: string;
+    required: boolean;
+}
+export interface HttpToolSpec {
+    name: string;
+    description: string;
+    fields: HttpToolField[];
+    method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+    url: string;
+    headers: {
+        key: string;
+        value: string;
+    }[];
+    sendFieldsAsJsonBody: boolean;
+    responseJsonPath?: string;
+}
+/** Generates agents/<agentName>/tools/<spec.name>.ts, registers it in
+ * that agent's tools/index.ts, then imports the file it just wrote and
+ * returns the real, callable ToolDefinition object — so the route
+ * handler (adapters/http.ts's POST /agents/:name/tools/http) can splice
+ * it straight into the live agent registry (core/agent-registry.ts's
+ * updateAgent) without guessing an export name or re-deriving anything
+ * this module already knows. */
+export declare function createHttpTool(agentName: string, spec: HttpToolSpec): Promise<{
+    path: string;
+    tool: ToolDefinition;
+}>;

package/dist/web/http-tool-admin.js

@@ -0,0 +1,223 @@
+// Lets an operator generate a real, hand-editable tool file from a
+// constrained form — the Tools tab's fourth section, alongside Local
+// tools/Subagents/Gateway Tools — instead of writing agents/<name>/
+// tools/<tool>.ts by hand. Deliberately narrow: the only thing this
+// generates is a parameterized HTTP call (method, a {field}-templated
+// URL, headers, an optional JSON body/response-path mapping), never
+// arbitrary code. A SKILL.md-style "store code as markdown, eval it at
+// request time" version of this was considered and rejected: SKILL.md
+// is safe specifically because its content is only ever read by the
+// model, never executed — this generates a normal, readable, type-
+// checked .ts file instead, the same class of artifact a human would
+// have written by hand, just templated for one well-understood shape.
+//
+// Field/URL/header substitution is compiled into the *generated code*
+// (a template literal with ${...} interpolations), not resolved at
+// generation time — so a value is only ever combined with the URL via
+// real encodeURIComponent, at call time, off whatever the model actually
+// passed as input. A header value may also reference {{ENV_VAR}} — the
+// generated code reads that from process.env at call time; the literal
+// secret itself is never accepted by this module, persisted to the
+// generated file, or echoed back through the admin API, the same
+// "always env-sourced, never a config literal" rule SendEmail/
+// HttpNotifierConfig's own secrets already follow (core/agent-config.ts).
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { agentDir } from '../core/gateway-tools.js';
+export class HttpToolNameError extends Error {
+}
+export class HttpToolExistsError extends Error {
+}
+export class HttpToolIndexShapeError extends Error {
+}
+const TOOL_NAME_PATTERN = /^[a-z][a-z0-9_]*$/;
+const FIELD_NAME_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+const ENV_VAR_PATTERN = /^[A-Z_][A-Z0-9_]*$/;
+// Same escaping bin/cli.ts's own local tsStringLiteral uses for a
+// single-quoted literal — duplicated here rather than imported, since
+// it's two lines and not worth a cross-module export for.
+function tsStringLiteral(value) {
+    return "'" + value.replace(/\\/g, '\\\\').replace(/'/g, "\\'") + "'";
+}
+// snake_case tool name -> camelCase export identifier, e.g.
+// "lookup_order_status" -> "lookupOrderStatus" — matches every
+// hand-written tool file's own convention (see agents/customer-service/
+// tools/*.ts: issue_refund.ts exports `issueRefund`, etc.).
+function toCamelCase(snakeCase) {
+    return snakeCase.replace(/_([a-z0-9])/g, (_, c) => c.toUpperCase());
+}
+// Escapes a literal segment for safe interpolation inside a generated
+// JS template literal (backtick string) — the three characters that
+// would otherwise break out of it or start a nested interpolation.
+function escapeTemplateLiteralSegment(segment) {
+    return segment.replace(/\\/g, '\\\\').replace(/`/g, '\\`').replace(/\$\{/g, '\\${');
+}
+/** Compiles a "{field}" template string into the *inside* of a JS
+ * template literal (caller wraps it in backticks) — each {field}
+ * becomes `${wrap(fieldExpr)}`, everything else is a literal segment,
+ * escaped for backtick safety. Throws if a referenced field isn't one
+ * of `fieldNames` — a typo'd placeholder should fail at generation
+ * time, not silently produce "undefined" in a live request later. */
+function compileFieldTemplate(template, fieldNames, wrap) {
+    let out = '';
+    let lastIndex = 0;
+    const pattern = /\{([a-zA-Z_][a-zA-Z0-9_]*)\}/g;
+    let match;
+    while ((match = pattern.exec(template))) {
+        out += escapeTemplateLiteralSegment(template.slice(lastIndex, match.index));
+        const field = match[1];
+        if (!fieldNames.has(field)) {
+            throw new HttpToolNameError(`Template references {${field}}, which isn't one of this tool's own fields.`);
+        }
+        out += '${' + wrap(`input.${field}`) + '}';
+        lastIndex = pattern.lastIndex;
+    }
+    out += escapeTemplateLiteralSegment(template.slice(lastIndex));
+    return out;
+}
+function generateToolCode(spec) {
+    const fieldNames = new Set(spec.fields.map((f) => f.name));
+    for (const field of spec.fields) {
+        if (!FIELD_NAME_PATTERN.test(field.name)) {
+            throw new HttpToolNameError(`Field name "${field.name}" must be a valid identifier (letters, digits, underscore, not starting with a digit).`);
+        }
+    }
+    // Every distinct {{ENV_VAR}} referenced across header values becomes
+    // one `const NAME = process.env.NAME` read (with a clear failure if
+    // unset), generated once up front — cleaner than inlining a
+    // read-and-check expression at every point of use, and it means a
+    // missing secret fails loudly the moment the tool actually runs, not
+    // silently as an empty header value.
+    const envVars = new Set();
+    const headerEntries = spec.headers.map(({ key, value }) => {
+        let compiled = '';
+        let lastIndex = 0;
+        const pattern = /\{\{([A-Z_][A-Z0-9_]*)\}\}|\{([a-zA-Z_][a-zA-Z0-9_]*)\}/g;
+        let match;
+        while ((match = pattern.exec(value))) {
+            compiled += escapeTemplateLiteralSegment(value.slice(lastIndex, match.index));
+            if (match[1]) {
+                if (!ENV_VAR_PATTERN.test(match[1])) {
+                    throw new HttpToolNameError(`"{{${match[1]}}}" isn't a valid env var name (uppercase letters, digits, underscore).`);
+                }
+                envVars.add(match[1]);
+                compiled += '${' + match[1] + '}';
+            }
+            else {
+                const field = match[2];
+                if (!fieldNames.has(field)) {
+                    throw new HttpToolNameError(`Header "${key}" references {${field}}, which isn't one of this tool's own fields.`);
+                }
+                compiled += '${String(input.' + field + ')}';
+            }
+            lastIndex = pattern.lastIndex;
+        }
+        compiled += escapeTemplateLiteralSegment(value.slice(lastIndex));
+        return { key, compiled };
+    });
+    const urlInner = compileFieldTemplate(spec.url, fieldNames, (expr) => `encodeURIComponent(String(${expr}))`);
+    const properties = spec.fields
+        .map((f) => `      ${JSON.stringify(f.name)}: { type: ${JSON.stringify(f.type)}${f.description ? `, description: ${JSON.stringify(f.description)}` : ''} },`)
+        .join('\n');
+    const required = spec.fields.filter((f) => f.required).map((f) => JSON.stringify(f.name));
+    const envReads = [...envVars]
+        .map((name) => `    const ${name} = process.env.${name}\n    if (!${name}) throw new Error(${tsStringLiteral(`${spec.name}: ${name} is not set`)})\n`)
+        .join('');
+    const headersObj = headerEntries.length === 0
+        ? ''
+        : `      headers: {\n${headerEntries.map(({ key, compiled }) => `        ${JSON.stringify(key)}: \`${compiled}\`,`).join('\n')}\n      },\n`;
+    const bodyLine = spec.sendFieldsAsJsonBody && spec.method !== 'GET' && spec.method !== 'DELETE' ? '      body: JSON.stringify(input),\n' : '';
+    const responseHandling = spec.responseJsonPath
+        ? (() => {
+            const segments = spec.responseJsonPath.split('.').filter(Boolean);
+            for (const seg of segments) {
+                if (!FIELD_NAME_PATTERN.test(seg)) {
+                    throw new HttpToolNameError(`responseJsonPath segment "${seg}" must be a valid identifier.`);
+                }
+            }
+            const access = segments.map((s) => `?.${s}`).join('');
+            return `    const body = await res.json()\n    return JSON.stringify(body${access} ?? null)\n`;
+        })()
+        : '    return await res.text()\n';
+    return `// Generated by the Admin UI's HTTP tool builder (Tools tab) — a
+// parameterized HTTP call, not hand-written logic. Edit freely for
+// anything this template can't express; the Admin UI only ever
+// regenerates a tool it created itself, never overwrites a file it
+// doesn't recognize (see web/http-tool-admin.ts's own HttpToolExistsError).
+import type { ToolDefinition } from 'loopengine'
+
+export const ${toCamelCase(spec.name)}: ToolDefinition = {
+  name: ${tsStringLiteral(spec.name)},
+  description: ${tsStringLiteral(spec.description)},
+  input_schema: {
+    type: 'object',
+    properties: {
+${properties}
+    },
+    required: [${required.join(', ')}],
+  },
+  execute: async (input) => {
+${envReads}    const res = await fetch(\`${urlInner}\`, {
+      method: ${tsStringLiteral(spec.method)},
+${headersObj}${bodyLine}    })
+    if (!res.ok) throw new Error(\`${spec.name}: HTTP \${res.status}\`)
+${responseHandling}  },
+}
+`;
+}
+// tools/index.ts's own shape is deliberately simple and consistent
+// across every real example in this repo (agents/customer-service/
+// tools/index.ts, create-loopengine's own template) — a handful of
+// named imports, then one `export const tools: ToolDefinition[] = [...]`
+// array literal. This patches that exact shape with two small string
+// edits (one new import line, one new array entry) rather than a full
+// TS-AST rewrite; if the file has been hand-edited into something this
+// pattern doesn't recognize, it refuses instead of risking corrupting it
+// — same "refuse rather than guess" discipline agent-file-admin.ts's own
+// doc comment already establishes for index.ts edits.
+function addToolToIndex(toolsIndexPath, toolFileName, exportName) {
+    const source = readFileSync(toolsIndexPath, 'utf8');
+    const arrayMatch = source.match(/export const tools: ToolDefinition\[\] = \[([^\]]*)\]/);
+    if (!arrayMatch) {
+        throw new HttpToolIndexShapeError(`${toolsIndexPath} doesn't match the expected "export const tools: ToolDefinition[] = [...]" shape — add this tool to it by hand instead.`);
+    }
+    const importLine = `import { ${exportName} } from './${toolFileName}.js'\n`;
+    const lastImportMatch = [...source.matchAll(/^import .+\n/gm)].pop();
+    const insertAt = lastImportMatch ? lastImportMatch.index + lastImportMatch[0].length : 0;
+    const withImport = source.slice(0, insertAt) + importLine + source.slice(insertAt);
+    const existingEntries = arrayMatch[1].trim();
+    const newEntries = existingEntries ? `${existingEntries}, ${exportName}` : exportName;
+    const withEntry = withImport.replace(/export const tools: ToolDefinition\[\] = \[([^\]]*)\]/, `export const tools: ToolDefinition[] = [${newEntries}]`);
+    writeFileSync(toolsIndexPath, withEntry);
+}
+/** Generates agents/<agentName>/tools/<spec.name>.ts, registers it in
+ * that agent's tools/index.ts, then imports the file it just wrote and
+ * returns the real, callable ToolDefinition object — so the route
+ * handler (adapters/http.ts's POST /agents/:name/tools/http) can splice
+ * it straight into the live agent registry (core/agent-registry.ts's
+ * updateAgent) without guessing an export name or re-deriving anything
+ * this module already knows. */
+export async function createHttpTool(agentName, spec) {
+    if (!TOOL_NAME_PATTERN.test(spec.name)) {
+        throw new HttpToolNameError(`Tool name must be lowercase snake_case (e.g. "lookup_order_status") — got "${spec.name}"`);
+    }
+    const toolsDir = join(agentDir(agentName), 'tools');
+    const toolPath = join(toolsDir, `${spec.name}.ts`);
+    if (existsSync(toolPath)) {
+        throw new HttpToolExistsError(`agents/${agentName}/tools/${spec.name}.ts already exists — pick a different name or edit it directly.`);
+    }
+    const code = generateToolCode(spec);
+    mkdirSync(toolsDir, { recursive: true });
+    writeFileSync(toolPath, code);
+    const indexPath = join(toolsDir, 'index.ts');
+    if (existsSync(indexPath)) {
+        addToolToIndex(indexPath, spec.name, toCamelCase(spec.name));
+    }
+    else {
+        writeFileSync(indexPath, `import type { ToolDefinition } from 'loopengine'\nimport { ${toCamelCase(spec.name)} } from './${spec.name}.js'\n\nexport const tools: ToolDefinition[] = [${toCamelCase(spec.name)}]\n`);
+    }
+    const exportName = toCamelCase(spec.name);
+    const mod = (await import(pathToFileURL(toolPath).href));
+    return { path: toolPath, tool: mod[exportName] };
+}

package/dist/web/skillgarden-admin.d.ts

@@ -0,0 +1,24 @@
+export declare class SkillgardenUnavailableError extends Error {
+}
+export interface SkillgardenCatalogEntry {
+    category: string;
+    id: string;
+    description: string;
+}
+export interface SkillgardenCatalogDetail extends SkillgardenCatalogEntry {
+    body: string;
+}
+export declare function listSkillgardenCatalog(): SkillgardenCatalogEntry[];
+export declare function readSkillgardenCatalogEntry(category: string, id: string): SkillgardenCatalogDetail;
+/** Copies `registry/<category>/<id>/` into `agents/<agentName>/skills/<id>/`
+ * — delegates entirely to skillgarden's own `addSkill`, which already
+ * knows this exact `agents/<agent>/skills` destination convention (see
+ * its own doc comment) and already refuses (or, with `force`,
+ * overwrites) an existing destination. Returns the bare skill id actually
+ * installed — never category-qualified, matching `addSkill`'s own
+ * "category is a registry-organization concept, not forced onto what a
+ * caller now owns" convention. */
+export declare function addSkillgardenSkillToAgent(agentName: string, category: string, id: string, force?: boolean): {
+    id: string;
+    path: string;
+};

package/dist/web/skillgarden-admin.js

@@ -0,0 +1,76 @@
+// Lets an operator browse skillgarden's own bundled skill registry from
+// the Skills tab in /agents/config, and add one straight into an agent's
+// agents/<name>/skills/ folder — a shortcut for the same thing
+// `npx skillgarden add <skill> --agent <name>` already does from a
+// terminal, surfaced in the UI instead. This module only ever *reads*
+// the registry and delegates the actual copy to skillgarden's own
+// exported `addSkill` (see below) — it never re-implements that logic.
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+import { SkillGarden, addSkill as skillgardenAddSkill } from 'skillgarden';
+export class SkillgardenUnavailableError extends Error {
+}
+// skillgarden's own CLI resolves its bundled registry/ relative to its
+// own compiled dist/cli.js location (see its cli.ts's own
+// DEFAULT_REGISTRY_DIR), but doesn't export that path — `addSkill`
+// itself defaults to it internally, which is enough for *installing* a
+// skill, but browsing/previewing the catalog needs the directory path
+// itself. Re-derived here the same way Node's own module resolution
+// would: from package.json's real installed location, not assumed
+// relative to this file (skillgarden is a real npm dependency, not a
+// vendored copy).
+function registryDir() {
+    const require = createRequire(import.meta.url);
+    let pkgJsonPath;
+    try {
+        pkgJsonPath = require.resolve('skillgarden/package.json');
+    }
+    catch {
+        throw new SkillgardenUnavailableError('skillgarden is not installed — run `npm install skillgarden` to enable the skill catalog.');
+    }
+    return join(dirname(pkgJsonPath), 'registry');
+}
+// A large, fixed budget, not run-agent.ts's own live skillIndexBudgetTokens
+// default — this indexes a small, fixed, bundled catalog for browsing,
+// not an agent's own live context, so nothing here should ever silently
+// truncate the list an operator sees.
+const CATALOG_INDEX_BUDGET_TOKENS = 1_000_000;
+// discoverSkillFiles namespaces registry/<category>/<skill>/SKILL.md as
+// "<category>:<skill>" (colon-joined, one level of nesting) — split on
+// just the first colon, not skillId itself, in case a future entry ever
+// nests deeper than one category level.
+function splitNamespacedName(namespacedName) {
+    const colon = namespacedName.indexOf(':');
+    return { category: namespacedName.slice(0, colon), id: namespacedName.slice(colon + 1) };
+}
+function catalogGarden() {
+    return new SkillGarden({ dirs: [registryDir()], indexBudgetTokens: CATALOG_INDEX_BUDGET_TOKENS });
+}
+export function listSkillgardenCatalog() {
+    const { included } = catalogGarden().buildIndex();
+    return included
+        .map((entry) => ({ ...splitNamespacedName(entry.name), description: entry.description }))
+        .sort((a, b) => (a.category === b.category ? a.id.localeCompare(b.id) : a.category.localeCompare(b.category)));
+}
+export function readSkillgardenCatalogEntry(category, id) {
+    const garden = catalogGarden();
+    garden.buildIndex();
+    // load() throws a plain Error for an unindexed name — same "not found"
+    // shape a bad category/id combination should surface as; the caller
+    // (adapters/http.ts) maps any throw here to 404, so there's nothing
+    // more specific to catch and re-throw.
+    const loaded = garden.load(`${category}:${id}`);
+    return { category, id, description: loaded.description, body: loaded.body };
+}
+/** Copies `registry/<category>/<id>/` into `agents/<agentName>/skills/<id>/`
+ * — delegates entirely to skillgarden's own `addSkill`, which already
+ * knows this exact `agents/<agent>/skills` destination convention (see
+ * its own doc comment) and already refuses (or, with `force`,
+ * overwrites) an existing destination. Returns the bare skill id actually
+ * installed — never category-qualified, matching `addSkill`'s own
+ * "category is a registry-organization concept, not forced onto what a
+ * caller now owns" convention. */
+export function addSkillgardenSkillToAgent(agentName, category, id, force = false) {
+    const result = skillgardenAddSkill({ skill: `${category}/${id}`, agent: agentName, registryDir: registryDir(), force });
+    return { id, path: join(result.destination, 'SKILL.md') };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loopengine",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "type": "module",
   "description": "Runtime for tool-using AI agents with a transparent ReAct loop.",
   "license": "MIT",
@@ -78,7 +78,7 @@
     "mcpplug": "^0.0.1",
     "openai": "^7.4.0",
     "sessionknit": "^0.0.2",
-    "skillgarden": "^0.0.5",
+    "skillgarden": "^0.0.9",
     "toollane": "^0.0.1",
     "typescript": "^5.7.0",
     "yaml": "^2.6.0"