loopengine 0.1.67 → 0.1.69

package/dist/web/decide-page.js

@@ -0,0 +1,138 @@
+// The page a decision link opens (GET /decide/<token>, see
+// core/approval-links.ts): what's waiting — the tool and its arguments,
+// or the question — and buttons to approve, deny or answer. Anyone with
+// the link can decide; the signed token is the only credential, so this
+// page shows nothing beyond the one decision it names.
+//
+// Rendered on the server; the small script only posts the choice back to
+// the same URL (POST /decide/<token>) and shows the outcome. Written
+// without backticks or backslashes inside the script, same convention as
+// the other embedded pages.
+import { devUiCss } from './dev-ui-styles.js';
+function esc(s) {
+    return String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
+}
+const PAGE_CSS = `
+  body { display: grid; place-items: start center; padding: 48px 16px; background: var(--surface); }
+  main { width: 100%; max-width: 560px; background: var(--bg); border: 1px solid var(--line); border-radius: 12px; padding: 24px; display: grid; gap: 16px; }
+  .brand { display: flex; align-items: center; gap: 8px; font-weight: 600; color: var(--ink-muted); font-size: 13px; }
+  .mark { width: 18px; height: 18px; border-radius: 5px; background: var(--accent); }
+  h1 { font-size: 20px; margin: 0; }
+  dl { display: grid; grid-template-columns: max-content minmax(0, 1fr); gap: 6px 16px; margin: 0; font-size: 13px; }
+  dt { color: var(--ink-faint); }
+  dd { margin: 0; overflow-wrap: anywhere; }
+  pre, textarea { font-family: var(--font-mono); font-size: 12.5px; background: var(--code-bg); border-radius: 8px; padding: 12px; margin: 0; white-space: pre-wrap; overflow-wrap: anywhere; }
+  textarea { width: 100%; min-height: 120px; border: 1px solid var(--line); }
+  .actions { display: flex; gap: 8px; flex-wrap: wrap; }
+  .actions button { padding: 8px 16px; }
+  .deny { color: var(--bad); }
+  .note { font-size: 12px; color: var(--ink-faint); margin: 0; }
+  .result { padding: 12px 14px; border-radius: 8px; background: var(--good-soft); color: var(--good); }
+  .result.bad { background: var(--bad-soft); color: var(--bad); }
+  .reply { white-space: pre-wrap; background: var(--surface); border-radius: 8px; padding: 12px 14px; }
+  details summary { cursor: pointer; font-size: 13px; color: var(--ink-muted); }
+`;
+function shell(title, body, script = '') {
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+<title>${esc(title)}</title>
+<style>${devUiCss}${PAGE_CSS}</style>
+</head>
+<body>
+<main>
+<div class="brand"><span class="mark" aria-hidden="true"></span>LoopEngine</div>
+${body}
+</main>
+${script}
+</body>
+</html>`;
+}
+/** A link that's malformed, tampered with, or past its expiry. */
+export function renderDecideInvalidPage() {
+    return shell('Link not valid', '<h1>This link isn&#39;t valid</h1><p class="muted">It may have expired or been copied incompletely. Ask for a new one, or decide from the agent&#39;s Permissions tab.</p>');
+}
+/** A valid link whose decision has already been made. */
+export function renderDecideGonePage() {
+    return shell('Already decided', '<h1>Already decided</h1><p class="muted">Someone has already made this decision, so there&#39;s nothing left to do here.</p>');
+}
+const SCRIPT = `<script>
+(function () {
+  var main = document.querySelector('main');
+  var result = document.getElementById('result');
+  function send(body, button) {
+    var buttons = main.querySelectorAll('button');
+    for (var i = 0; i < buttons.length; i++) buttons[i].disabled = true;
+    result.hidden = false;
+    result.className = 'result';
+    result.textContent = 'Sending' + String.fromCharCode(8230);
+    fetch(location.pathname, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) })
+      .then(function (r) { return r.json().then(function (j) { return { ok: r.ok, body: j }; }); })
+      .then(function (r) {
+        if (!r.ok) throw new Error(r.body.error || 'request failed');
+        var form = document.getElementById('decision');
+        if (form) form.hidden = true;
+        result.textContent = r.body.message || (body.decision === 'deny' ? 'Denied.' : body.answer !== undefined ? 'Answer sent.' : 'Approved.');
+        if (r.body.text) {
+          var reply = document.createElement('div');
+          reply.className = 'reply';
+          reply.textContent = r.body.text;
+          result.after(reply);
+        }
+      })
+      .catch(function (err) {
+        result.className = 'result bad';
+        result.textContent = err.message;
+        for (var i = 0; i < buttons.length; i++) buttons[i].disabled = false;
+      });
+  }
+  main.addEventListener('click', function (ev) {
+    var btn = ev.target.closest('button[data-send]');
+    if (!btn) return;
+    var payload = JSON.parse(btn.getAttribute('data-send'));
+    if (payload.editedFrom) {
+      try { payload = { decision: 'approve', editedArgs: JSON.parse(document.getElementById(payload.editedFrom).value) }; }
+      catch (e) { result.hidden = false; result.className = 'result bad'; result.textContent = 'The arguments aren' + String.fromCharCode(39) + 't valid JSON.'; return; }
+    }
+    if (payload.answerFrom) {
+      var text = document.getElementById(payload.answerFrom).value.trim();
+      if (!text) return;
+      payload = { answer: text };
+    }
+    send(payload, btn);
+  });
+})();
+</script>`;
+export function renderDecidePage(item) {
+    const expires = new Date(item.expiresAt).toUTCString();
+    const facts = `<dl><dt>Agent</dt><dd>${esc(item.agent)}</dd>` +
+        `<dt>Conversation</dt><dd><code>${esc(item.sessionId)}</code>${item.tenant && item.tenant !== 'default' ? ` (tenant ${esc(item.tenant)})` : ''}</dd>` +
+        (item.createdAt ? `<dt>Asked</dt><dd>${esc(new Date(item.createdAt).toUTCString())}</dd>` : '') +
+        `</dl>`;
+    const note = `<p class="note">Anyone with this link can make this decision. It works once and expires ${esc(expires)}.</p>`;
+    const result = '<div id="result" class="result" hidden role="status"></div>';
+    if (item.kind === 'question') {
+        const question = typeof item.args.question === 'string' ? item.args.question : item.reason;
+        const options = Array.isArray(item.args.options) ? item.args.options.map(String) : [];
+        const optionButtons = options.map((o) => `<button type="button" data-send="${esc(JSON.stringify({ answer: o }))}">${esc(o)}</button>`).join('');
+        return shell(`Question from ${item.agent}`, `<h1>${esc(item.agent)} has a question</h1>${facts}<pre>${esc(question)}</pre>` +
+            `<div id="decision" style="display:grid;gap:10px">` +
+            (optionButtons ? `<div class="actions">${optionButtons}</div>` : '') +
+            `<label style="display:grid;gap:6px;font-size:13px">${options.length ? 'Or answer in your own words' : 'Your answer'}<textarea id="answerText" style="min-height:80px;font-family:var(--font-sans)"></textarea></label>` +
+            `<div class="actions"><button type="button" class="primary" data-send="${esc(JSON.stringify({ answerFrom: 'answerText' }))}">Send answer</button></div></div>` +
+            result + note, SCRIPT);
+    }
+    return shell(`Approve ${item.tool}?`, `<h1>Approve <code>${esc(item.tool)}</code>?</h1>${facts}` +
+        `<pre>${esc(JSON.stringify(item.args, null, 2))}</pre>` +
+        `<p class="muted" style="margin:0">${esc(item.reason)}</p>` +
+        `<div id="decision" style="display:grid;gap:12px">` +
+        `<div class="actions"><button type="button" class="primary" data-send="${esc(JSON.stringify({ decision: 'approve' }))}">Approve</button>` +
+        `<button type="button" class="deny" data-send="${esc(JSON.stringify({ decision: 'deny' }))}">Deny</button></div>` +
+        `<details><summary>Change the arguments first</summary><div style="display:grid;gap:8px;margin-top:8px">` +
+        `<textarea id="editedArgs">${esc(JSON.stringify(item.args, null, 2))}</textarea>` +
+        `<div class="actions"><button type="button" data-send="${esc(JSON.stringify({ editedFrom: 'editedArgs' }))}">Approve with these arguments</button></div></div></details>` +
+        `</div>` + result + note, SCRIPT);
+}

package/dist/web/notifier-admin.d.ts

@@ -2,6 +2,7 @@ import type { AgentConfig } from '../core/agent-config.js';
 import type { CheckpointStore } from '../core/durable-approvals.js';
 import { type DeliveryResult } from '../core/http-notify-triggers/webhook.js';
 import { type NotifierFileChannel } from '../core/notifier-file.js';
+import { type SlackChannel } from '../core/slack-interactions.js';
 /** The deployment-wide default webhook (LOOPENGINE_DEFAULT_WEBHOOK_URL /
  * _SECRET), which applies to the plain /messages route when an agent has
  * no notifier of its own. */
@@ -17,6 +18,12 @@ export declare function describeAgentNotifier(config: AgentConfig, defaultWebhoo
     secretsSet: {
         [k: string]: boolean;
     };
+    slack: {
+        signingSecretVar: string;
+        signingSecretSet: boolean;
+        interactivityPath: string;
+        manifestTemplate: Record<string, unknown>;
+    };
     deliveries: import("../core/notifier-deliveries.js").NotifierDelivery[];
     channel?: import("../core/agent-config.js").HttpNotifierConfig["channel"];
     events?: string[];
@@ -28,6 +35,17 @@ export declare function describeAgentNotifier(config: AgentConfig, defaultWebhoo
  * form includes one, the channel's secret into the agent's own env.
  * Throws NotifierFileError for an invalid form. */
 export declare function saveAgentNotifier(config: AgentConfig, body: Record<string, unknown>): Promise<void>;
+/** The bot token and signing secret behind an agent's Slack notifier —
+ * from AgentConfig.httpNotifier when it's Slack, else from the agent's
+ * env (the console-saved ones). The signing secret always comes from the
+ * agent env. */
+export declare function slackCredentialsFor(config: AgentConfig): {
+    botToken?: string;
+    signingSecret?: string;
+};
+/** Channels for the console's picker, with the token being typed in or,
+ * when none is given, the one already saved. */
+export declare function listAgentSlackChannels(config: AgentConfig, botToken?: string): Promise<SlackChannel[]>;
 /** Removes notifier.yml; the stored secret is left alone, so turning the
  * notifier back on doesn't need it re-entered. */
 export declare function removeAgentNotifier(config: AgentConfig): void;
@@ -39,6 +57,7 @@ export declare function testAgentNotifier(config: AgentConfig, defaultWebhook?:
 /** Every decision still waiting for this agent, oldest first, each with
  * where to send the answer. */
 export declare function listAgentPending(store: CheckpointStore, agentName: string): Promise<({
+    decidePath: string;
     answerPath: string;
     pendingId: string;
     kind: "approval" | "question";
@@ -49,6 +68,7 @@ export declare function listAgentPending(store: CheckpointStore, agentName: stri
     tenant: string;
     createdAt: string | null;
 } | {
+    decidePath: string;
     resolvePath: string;
     pendingId: string;
     kind: "approval" | "question";

package/dist/web/notifier-admin.js

@@ -1,9 +1,11 @@
 import { agentDirFor, createAgentEnv } from '../core/agent-env.js';
+import { decidePath } from '../core/approval-links.js';
 import { describeNotifier } from '../core/http-notifier.js';
 import { sendTestSlackMessage } from '../core/http-notify-triggers/slack.js';
 import { sendTestWebhook } from '../core/http-notify-triggers/webhook.js';
 import { listDeliveries } from '../core/notifier-deliveries.js';
-import { NOTIFIER_SECRET_VARS, notifierConfigFromFile, readNotifierFile, removeNotifierFile, writeNotifierFile } from '../core/notifier-file.js';
+import { NOTIFIER_SECRET_VARS, NOTIFIER_SLACK_SIGNING_SECRET_VAR, notifierConfigFromFile, readNotifierFile, removeNotifierFile, writeNotifierFile } from '../core/notifier-file.js';
+import { listSlackChannels, slackAppManifest } from '../core/slack-interactions.js';
 import { setAgentEnvVar } from './env-admin.js';
 export function describeAgentNotifier(config, defaultWebhook) {
     const described = describeNotifier(config);
@@ -17,6 +19,15 @@ export function describeAgentNotifier(config, defaultWebhook) {
         publicUrl: process.env.LOOPENGINE_PUBLIC_URL ?? null,
         secretVars: NOTIFIER_SECRET_VARS,
         secretsSet,
+        slack: {
+            signingSecretVar: NOTIFIER_SLACK_SIGNING_SECRET_VAR,
+            signingSecretSet: env.get(NOTIFIER_SLACK_SIGNING_SECRET_VAR) !== undefined,
+            // Where the Slack app's Interactivity Request URL should point.
+            interactivityPath: `/hooks/slack/${encodeURIComponent(config.name)}`,
+            // The console swaps __INTERACTIVITY_URL__ for the link address +
+            // interactivityPath as you type.
+            manifestTemplate: slackAppManifest({ agentName: config.name, interactivityUrl: '__INTERACTIVITY_URL__' }),
+        },
         deliveries: listDeliveries(config.name),
     };
 }
@@ -28,6 +39,26 @@ export async function saveAgentNotifier(config, body) {
     if (typeof body.secret === 'string' && body.secret.trim()) {
         await setAgentEnvVar(config.name, NOTIFIER_SECRET_VARS[file.channel], body.secret.trim());
     }
+    if (file.channel === 'slack' && typeof body.signingSecret === 'string' && body.signingSecret.trim()) {
+        await setAgentEnvVar(config.name, NOTIFIER_SLACK_SIGNING_SECRET_VAR, body.signingSecret.trim());
+    }
+}
+/** The bot token and signing secret behind an agent's Slack notifier —
+ * from AgentConfig.httpNotifier when it's Slack, else from the agent's
+ * env (the console-saved ones). The signing secret always comes from the
+ * agent env. */
+export function slackCredentialsFor(config) {
+    const env = createAgentEnv(config.name, agentDirFor(config));
+    const botToken = config.httpNotifier?.channel === 'slack' ? config.httpNotifier.config.botToken : env.get(NOTIFIER_SECRET_VARS.slack);
+    return { botToken, signingSecret: env.get(NOTIFIER_SLACK_SIGNING_SECRET_VAR) };
+}
+/** Channels for the console's picker, with the token being typed in or,
+ * when none is given, the one already saved. */
+export async function listAgentSlackChannels(config, botToken) {
+    const token = botToken?.trim() || slackCredentialsFor(config).botToken;
+    if (!token)
+        throw new Error('Enter the bot token first');
+    return listSlackChannels(token);
 }
 /** Removes notifier.yml; the stored secret is left alone, so turning the
  * notifier back on doesn't need it re-entered. */
@@ -81,6 +112,8 @@ export async function listAgentPending(store, agentName) {
                 tenant: checkpoint.tenant,
                 createdAt: checkpoint.createdAt ?? null,
                 ...(kind === 'question' ? { answerPath: `/pending-questions/${pendingId}/answer` } : { resolvePath: `/pending-approvals/${pendingId}/resolve` }),
+                // A signed link anyone can open to decide (core/approval-links.ts).
+                decidePath: decidePath(pendingId, kind),
             });
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loopengine",
-  "version": "0.1.67",
+  "version": "0.1.69",
   "type": "module",
   "description": "Runtime for tool-using AI agents with a transparent ReAct loop.",
   "license": "MIT",
@@ -48,6 +48,10 @@
     "dist/core/notifier-file.d.ts",
     "dist/core/notifier-deliveries.js",
     "dist/core/notifier-deliveries.d.ts",
+    "dist/core/approval-links.js",
+    "dist/core/approval-links.d.ts",
+    "dist/core/slack-interactions.js",
+    "dist/core/slack-interactions.d.ts",
     "dist/core/session-store.js",
     "dist/core/session-store.d.ts",
     "dist/core/vector-index.js",