loopengine 0.1.48 → 0.1.49

package/dist/bin/ability-manager.d.ts

@@ -17,6 +17,15 @@ export interface AbilityEnvDecl {
      * of a free-text field. Omit for anything that isn't genuinely a fixed
      * enum (an API key, a free-form model name, a path, ...). */
     options?: string[];
+    /** True for a value that's naturally multi-line (a pasted JSON key
+     * file, a PEM block, ...) — the Admin UI renders a <textarea> instead
+     * of a single-line <input>, which per the HTML spec's own value
+     * sanitization strips line breaks entirely and would otherwise mangle
+     * exactly this kind of value on paste, regardless of how correctly the
+     * .env file itself round-trips real embedded newlines (see
+     * env-admin.ts's own serializeEnvValue doc comment). Omit for anything
+     * genuinely single-line. */
+    multiline?: boolean;
 }
 /** `name`/`version` deliberately aren't declared here — they're read off
  * the ability's own sibling `package.json` instead (see readManifest),

package/dist/web/agents-config-page.js

@@ -1187,11 +1187,21 @@ export const agentsConfigPageHtml = `<!doctype html>
     // field, so there's nothing to mistype — the same "value" form field
     // name either element uses means wireEnvHandlers's own submit
     // handler doesn't need to know which one it's looking at.
+    // A naturally multi-line value (AbilityEnvDecl.multiline, e.g. a
+    // pasted JSON key file) gets a <textarea> — a single-line <input>
+    // (even type="text") strips embedded line breaks from its value
+    // entirely per the HTML spec's own value sanitization, mangling
+    // exactly this kind of paste. No password-style masking for it
+    // either — <textarea> has no such mode, and masking a large blob
+    // secret buys little anyway compared to being able to paste it
+    // correctly at all.
     var fieldHtml = v.options
       ? '<select name="value">' + v.options.map(function (opt) {
           return '<option value="' + escapeHtml(opt) + '"' + (v.value === opt ? ' selected' : '') + '>' + escapeHtml(opt) + '</option>';
         }).join('') + '</select>'
-      : '<input type="' + (v.secret ? 'password' : 'text') + '" name="value" placeholder="' + (v.set ? 'unchanged unless you type a new value' : 'value') + '" required>';
+      : v.multiline
+        ? '<textarea name="value" rows="8" placeholder="' + (v.set ? 'unchanged unless you paste a new value' : 'paste the full value') + '" required></textarea>'
+        : '<input type="' + (v.secret ? 'password' : 'text') + '" name="value" placeholder="' + (v.set ? 'unchanged unless you type a new value' : 'value') + '" required>';
     return '<tr>' +
       '<td><code>' + escapeHtml(v.name) + '</code>' + sharedNote + '</td>' +
       '<td style="max-width:320px">' + escapeHtml(v.description || '') + '</td>' +

package/dist/web/env-admin.d.ts

@@ -18,6 +18,11 @@ export interface DeclaredEnvVar {
      * only when the declaring ability actually named one; the Admin UI
      * renders a dropdown instead of a free-text field when this is set. */
     options?: string[];
+    /** True for a naturally multi-line value (see AbilityEnvDecl.multiline)
+     * — the Admin UI renders a <textarea> instead of a single-line
+     * <input>, which strips embedded line breaks entirely per the HTML
+     * spec's own value sanitization. */
+    multiline?: boolean;
 }
 /** Every env var any ability installed for `agentName` declared it
  * needs, merged by name. There's one .env per *project*, not per agent

package/dist/web/env-admin.js

@@ -66,6 +66,7 @@ export function listDeclaredEnvVars(agentName) {
                 set: rawValue !== undefined,
                 value: decl.secret === true ? undefined : rawValue,
                 options: decl.options,
+                multiline: decl.multiline,
             });
         }
     }
@@ -81,13 +82,26 @@ function envFilePath() {
     return join(process.cwd(), '.env');
 }
 // Node's own --env-file parser (what bin/cli.ts's runTsx already passes
-// as --env-file-if-exists=.env) double-quotes a value containing
-// whitespace, '#', or a quote character — matched here so a value this
-// function writes reads back identically, not reinterpreted as a
-// comment or truncated at the first space.
+// as --env-file-if-exists=.env) needs a value containing whitespace, '#',
+// or a quote character quoted, so it reads back as one value instead of
+// being reinterpreted as a comment or truncated at the first space.
+// Single-quoting wins over double — confirmed live against Node's actual
+// parser that a single-quoted value reads back fully literally, with no
+// backslash-escape processing inside it at all: a real embedded newline,
+// a literal double-quote, or a literal backslash (a JSON secret like
+// GOOGLE_APPLICATION_CREDENTIALS_JSON has all three at once) all survive
+// untouched. Double-quoting a value with an *escaped* embedded quote does
+// NOT round-trip — confirmed live that Node's parser has no support for
+// \" as an escaped literal quote inside a double-quoted value; it just
+// ends the value there instead (`X="a\"b"` reads back as only `a\`,
+// silently dropping `b"` entirely). The double-quote fallback below is
+// only reached when the value itself contains a literal single quote —
+// the one character single-quoting can't represent at all.
 function serializeEnvValue(value) {
     if (!/[\s#"'\\]/.test(value) && value !== '')
         return value;
+    if (!value.includes("'"))
+        return `'${value}'`;
     return `"${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
 }
 /** Upserts `NAME=VALUE` into the project's `.env` file — preserving

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loopengine",
-  "version": "0.1.48",
+  "version": "0.1.49",
   "type": "module",
   "description": "Runtime for tool-using AI agents with a transparent ReAct loop.",
   "license": "MIT",