loopengine 0.1.41 → 0.1.43

package/dist/bin/ability-manager.d.ts

@@ -63,6 +63,14 @@ export interface InstalledAbilityRecord {
     skills: string[];
     actauthRules: string[];
     env: AbilityEnvDecl[];
+    /** Real npm package names (dependencies + optionalDependencies) the
+     * ability's own tool files import, as of the last install/upgrade —
+     * same values AbilityManifest.dependencies carries, persisted here so
+     * the Admin UI's "Install dependencies" button can read them back
+     * without refetching the ability from its spec. Optional only because
+     * an ability installed before this field existed has no recorded
+     * value. */
+    dependencies?: string[];
     /** relative path (e.g. "tools/foo.ts") -> sha256 hex, as of the last
      * install/upgrade — remove-ability's dirty-check compares against
      * this rather than storing/refetching full content to diff. */
@@ -76,6 +84,20 @@ export interface InstalledAbilityRecord {
 export declare function listInstalledAbilities(agentName: string): Array<{
     name: string;
 } & InstalledAbilityRecord>;
+/** `record.dependencies` is only ever absent for an ability installed or
+ * last upgraded before that field existed (see InstalledAbilityRecord's
+ * own doc comment) — this re-derives it once by refetching the ability's
+ * own manifest (same technique upgradeAbility already uses for its own
+ * three-way merge base) and persists the result into provenance, so this
+ * only ever runs once per such ability rather than on every read. A
+ * record that already has `dependencies` — even a real empty array,
+ * meaning the ability genuinely declares none — is returned unchanged,
+ * never refetched. Best-effort: a spec that no longer resolves (private
+ * registry auth expired, a git ref that's gone, ...) leaves
+ * `dependencies` unset rather than throwing, since the Admin UI's own
+ * caller (handleAbilitiesGet) would rather show "can't tell" than fail
+ * the whole abilities list over one ability's stale record. */
+export declare function backfillDependencies(agentName: string, abilityName: string, options?: FetchOptions): Promise<string[] | undefined>;
 /** `npm pack <spec>` + tar extract — generalized from
  * create-loopengine's own `fetchPublishedTemplateDir` (that function
  * only ever fetches the hardcoded `create-loopengine@<version>`; this

package/dist/bin/ability-manager.js

@@ -166,6 +166,39 @@ export function listInstalledAbilities(agentName) {
 function writeProvenance(agentName, data) {
     writeFileSync(provenancePath(agentName), JSON.stringify(data, null, 2) + '\n');
 }
+/** `record.dependencies` is only ever absent for an ability installed or
+ * last upgraded before that field existed (see InstalledAbilityRecord's
+ * own doc comment) — this re-derives it once by refetching the ability's
+ * own manifest (same technique upgradeAbility already uses for its own
+ * three-way merge base) and persists the result into provenance, so this
+ * only ever runs once per such ability rather than on every read. A
+ * record that already has `dependencies` — even a real empty array,
+ * meaning the ability genuinely declares none — is returned unchanged,
+ * never refetched. Best-effort: a spec that no longer resolves (private
+ * registry auth expired, a git ref that's gone, ...) leaves
+ * `dependencies` unset rather than throwing, since the Admin UI's own
+ * caller (handleAbilitiesGet) would rather show "can't tell" than fail
+ * the whole abilities list over one ability's stale record. */
+export async function backfillDependencies(agentName, abilityName, options = {}) {
+    const provenance = readProvenance(agentName);
+    const record = provenance[abilityName];
+    if (!record)
+        return undefined;
+    if (record.dependencies !== undefined)
+        return record.dependencies;
+    const fetch = options.fetchAbilityDir ?? fetchAbilityDir;
+    try {
+        const dir = fetch(record.spec ?? abilityName);
+        const manifest = readManifest(dir);
+        record.dependencies = manifest.dependencies ?? [];
+        provenance[abilityName] = record;
+        writeProvenance(agentName, provenance);
+        return record.dependencies;
+    }
+    catch {
+        return undefined;
+    }
+}
 function sha256(content) {
     return createHash('sha256').update(content).digest('hex');
 }
@@ -454,6 +487,7 @@ export async function installAbility(agentName, spec, options = {}) {
         skills: skillIds,
         actauthRules: ruleNames,
         env: manifest.env ?? [],
+        dependencies: manifest.dependencies ?? [],
         contentHashes,
     };
     writeProvenance(agentName, provenance);
@@ -633,7 +667,14 @@ export async function upgradeAbility(agentName, abilityName, options = {}) {
         updateActauthRule(agentName, ruleName, { scope: newRule.scope, tool: newRule.tool, decision: newRule.decision });
         results.push({ path, status: 'updated' });
     }
-    provenance[abilityName] = { ...record, version: newManifest.version, spec, contentHashes: newContentHashes, env: newManifest.env ?? record.env };
+    provenance[abilityName] = {
+        ...record,
+        version: newManifest.version,
+        spec,
+        contentHashes: newContentHashes,
+        env: newManifest.env ?? record.env,
+        dependencies: newManifest.dependencies ?? record.dependencies,
+    };
     writeProvenance(agentName, provenance);
     return { files: results };
 }

package/dist/index.d.ts

@@ -57,7 +57,7 @@ export { listDeclaredEnvVars, setEnvVar, EnvVarNameError } from './web/env-admin
 export type { DeclaredEnvVar } from './web/env-admin.js';
 export { readActauthConfig, addActauthRule, updateActauthRule, removeActauthRule, setDefaultDecision, ActauthRuleExistsError, ActauthRuleNotFoundError, } from './web/actauth-admin.js';
 export type { ActauthRuleInput, ActauthConfigView } from './web/actauth-admin.js';
-export { installAbility, upgradeAbility, listInstalledAbilities, AbilityManifestError, AbilityVersionError, AbilityCollisionError, AbilityAlreadyInstalledError, AbilityNotInstalledError, } from './bin/ability-manager.js';
+export { installAbility, upgradeAbility, listInstalledAbilities, backfillDependencies, AbilityManifestError, AbilityVersionError, AbilityCollisionError, AbilityAlreadyInstalledError, AbilityNotInstalledError, } from './bin/ability-manager.js';
 export type { InstalledAbilityRecord, AbilityEnvDecl, UpgradeFileResult } from './bin/ability-manager.js';
 export { searchPublicAbilities, fetchLatestAbilityVersion } from './web/abilities-admin.js';
 export type { PublicAbilitySearchResult } from './web/abilities-admin.js';

package/dist/index.js

@@ -51,7 +51,7 @@ export { playgroundHtml } from './web/playground.js';
 export { readSkill, writeSkill, deleteSkill, SkillInvalidIdError, SkillNotFoundError } from './web/skills-admin.js';
 export { listDeclaredEnvVars, setEnvVar, EnvVarNameError } from './web/env-admin.js';
 export { readActauthConfig, addActauthRule, updateActauthRule, removeActauthRule, setDefaultDecision, ActauthRuleExistsError, ActauthRuleNotFoundError, } from './web/actauth-admin.js';
-export { installAbility, upgradeAbility, listInstalledAbilities, AbilityManifestError, AbilityVersionError, AbilityCollisionError, AbilityAlreadyInstalledError, AbilityNotInstalledError, } from './bin/ability-manager.js';
+export { installAbility, upgradeAbility, listInstalledAbilities, backfillDependencies, AbilityManifestError, AbilityVersionError, AbilityCollisionError, AbilityAlreadyInstalledError, AbilityNotInstalledError, } from './bin/ability-manager.js';
 export { searchPublicAbilities, fetchLatestAbilityVersion } from './web/abilities-admin.js';
 export { describeModelProviders, describeGateways } from './web/global-config.js';
 export { createTrackedApprover, listApprovals, decideApproval, findApproval } from './web/web-approver.js';

package/dist/web/agents-config-page.js

@@ -75,15 +75,18 @@ export const agentsConfigPageHtml = `<!doctype html>
     flex-direction: column;
   }
   #agentList { list-style: none; margin: 0; padding: 6px; flex: 1; }
-  #agentList li {
+  #agentList li { border-radius: 6px; }
+  #agentList li a {
+    display: block;
     padding: 8px 10px;
     border-radius: 6px;
-    cursor: pointer;
     font-size: 13px;
     font-family: ui-monospace, monospace;
+    color: inherit;
+    text-decoration: none;
   }
-  #agentList li:hover { background: light-dark(#eee, #26262b); }
-  #agentList li.active { background: light-dark(#dbeafe, #1e3a5f); font-weight: 600; }
+  #agentList li a:hover { background: light-dark(#eee, #26262b); }
+  #agentList li.active a { background: light-dark(#dbeafe, #1e3a5f); font-weight: 600; }
   main {
     flex: 1;
     overflow-y: auto;
@@ -1297,6 +1300,14 @@ export const agentsConfigPageHtml = `<!doctype html>
     var actionHtml = a.upToDate
       ? '<span class="hint">up to date</span>'
       : '<button type="button" class="ability-upgrade-btn" data-name="' + escapeHtml(a.name) + '">Upgrade</button>';
+    // Same reasoning as upToDate above — missingDependencies (see
+    // hasNodeModule) only ever hides this once the server actually
+    // found every dependency already present in node_modules; anything
+    // it can't confirm still shows the button.
+    var deps = a.missingDependencies || [];
+    if (deps.length) {
+      actionHtml += ' <button type="button" class="ability-install-deps-btn" data-name="' + escapeHtml(a.name) + '" title="npm install ' + escapeHtml(deps.join(' ')) + '">Install deps</button>';
+    }
     return '<tr>' +
       '<td><code>' + escapeHtml(a.name) + '</code></td>' +
       '<td>' + escapeHtml(a.version) + '</td>' +
@@ -1372,8 +1383,10 @@ export const agentsConfigPageHtml = `<!doctype html>
           // has to be installed separately, or the tool fails at runtime
           // with an opaque "Cannot find package" the very next time this
           // agent's config is loaded. Surfaced here, loudly, instead of
-          // leaving that as a silent trap discovered later.
-          message += ' <strong>This ability also needs: <code>npm install ' + escapeHtml(deps.join(' ')) + '</code></strong> in your own project before it will actually work.';
+          // leaving that as a silent trap discovered later — the
+          // Installed table below now has its own "Install deps" button
+          // for exactly this (see handleAbilityInstallDepsPost).
+          message += ' <strong>This ability also needs: <code>' + escapeHtml(deps.join(', ')) + '</code></strong> — use the "Install deps" button below, or run <code>npm install ' + escapeHtml(deps.join(' ')) + '</code> yourself.';
         }
         statusEl.innerHTML = message;
         loadAbilitiesTab(name);
@@ -1427,6 +1440,39 @@ export const agentsConfigPageHtml = `<!doctype html>
       });
   }
 
+  // Runs npm install for an ability's own missing dependencies
+  // (handleAbilityInstallDepsPost) — the server reads the dependency
+  // list back off this ability's own installed record, not anything
+  // this form could tamper with, so there's nothing to pass except
+  // which ability. Can take a while (a native module like sharp
+  // especially), so the button stays disabled and the status line says
+  // so rather than looking hung.
+  function installAbilityDeps(name, abilityName, statusEl, btn) {
+    if (btn) { btn.disabled = true; }
+    statusEl.className = 'hint';
+    statusEl.textContent = 'Running npm install for ' + abilityName + '’s dependencies… this can take a minute.';
+    fetch('/agents/' + encodeURIComponent(name) + '/abilities/' + encodeURIComponent(abilityName) + '/install-deps', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({}),
+    })
+      .then(function (r) { return r.json().then(function (j) { return { ok: r.ok, body: j }; }); })
+      .then(function (result) {
+        if (!result.ok) throw new Error(result.body.error || 'request failed');
+        var installed = result.body.installed || [];
+        statusEl.className = 'hint';
+        statusEl.textContent = installed.length
+          ? 'Installed: ' + installed.join(', ') + '. Restart the server to pick it up.'
+          : abilityName + ' had no dependencies to install.';
+        loadAbilitiesTab(name);
+      })
+      .catch(function (err) {
+        statusEl.className = 'error';
+        statusEl.textContent = 'Could not install dependencies: ' + err.message;
+        if (btn) { btn.disabled = false; }
+      });
+  }
+
   // Shared by the initial (empty-query) load right after the tab opens
   // and the search form's own submit — the empty-query case is just
   // "list every published ability" (the keyword filter alone, no extra
@@ -1468,6 +1514,14 @@ export const agentsConfigPageHtml = `<!doctype html>
       });
     }
 
+    var installDepsBtns = content.querySelectorAll('.ability-install-deps-btn');
+    for (var d = 0; d < installDepsBtns.length; d++) {
+      installDepsBtns[d].addEventListener('click', function (ev) {
+        var btn = ev.currentTarget;
+        installAbilityDeps(name, btn.dataset.name, upgradeStatusEl, btn);
+      });
+    }
+
     var searchForm = content.querySelector('#abilitySearchForm');
     var resultsEl = content.querySelector('#abilitySearchResults');
     if (searchForm && resultsEl) {
@@ -2461,9 +2515,17 @@ export const agentsConfigPageHtml = `<!doctype html>
       for (var i = 0; i < agents.length; i++) {
         (function (name) {
           var li = document.createElement('li');
-          li.textContent = name;
           li.dataset.name = name;
-          li.addEventListener('click', function () { selectAgent(name); });
+          // A real <a href>, not a click handler calling selectAgent —
+          // switching agents is a full navigation to this same page with
+          // a different ?agent=, so the URL, browser back/forward, and
+          // bookmarking all reflect which agent is open, instead of the
+          // URL staying frozen at whatever it was on first load while
+          // the panel silently swaps underneath it via fetch.
+          var a = document.createElement('a');
+          a.href = '/agents/config?agent=' + encodeURIComponent(name);
+          a.textContent = name;
+          li.appendChild(a);
           agentList.appendChild(li);
         })(agents[i].name);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loopengine",
-  "version": "0.1.41",
+  "version": "0.1.43",
   "type": "module",
   "description": "Runtime for tool-using AI agents with a transparent ReAct loop.",
   "license": "MIT",