loopengine 0.1.72 → 0.1.74

package/dist/core/secret-store.js

@@ -5,7 +5,7 @@
 // self-hosted install has always used. A host that keeps secrets
 // somewhere else (a hosted control plane's vault, Vault, a cloud secret
 // manager) swaps it in once at startup with setSecretStore().
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { parseEnv } from 'node:util';
 export function agentEnvFilePath(dir) {
@@ -72,7 +72,13 @@ function upsertEnvFileLine(path, name, value) {
     else {
         lines[existingIndex] = newLine;
     }
-    writeFileSync(path, lines.join('\n') + '\n');
+    writeEnvFile(path, lines.join('\n') + '\n');
+}
+/** .env files hold secrets: owner-only (0600), including one that
+ * already existed with wider permissions. */
+function writeEnvFile(path, content) {
+    writeFileSync(path, content, { mode: 0o600 });
+    chmodSync(path, 0o600);
 }
 /** Removes NAME= from the .env file at `path`, if present. Only
  * rewrites the file when something actually changed — a no-op removal
@@ -84,7 +90,7 @@ function removeEnvFileLine(path, name) {
     const lines = readFileSync(path, 'utf8').split('\n');
     const filtered = lines.filter((line) => !line.startsWith(`${name}=`));
     if (filtered.length !== lines.length)
-        writeFileSync(path, filtered.join('\n').replace(/\n*$/, '\n'));
+        writeEnvFile(path, filtered.join('\n').replace(/\n*$/, '\n'));
 }
 /** The project's .env for shared values, agents/<name>/.env for each
  * agent's own — the default, and what every self-hosted install uses. */

package/dist/index.d.ts

@@ -77,7 +77,7 @@ export { installAbility, upgradeAbility, removeAbility, listInstalledAbilities,
 export type { InstalledAbilityRecord, AbilityEnvDecl, UpgradeFileResult } from './bin/ability-manager.js';
 export { searchPublicAbilities, fetchLatestAbilityVersion } from './web/abilities-admin.js';
 export type { PublicAbilitySearchResult } from './web/abilities-admin.js';
-export { describeModelProviders, describeGateways } from './web/global-config.js';
+export { describeModelProviders, describeGateways, setModelProviderKey, clearModelProviderKey, ModelKeyError } from './web/global-config.js';
 export type { ModelProviderInfo, AgentModelUsage, ModelsView, GatewayProviderInfo, GatewaysView } from './web/global-config.js';
 export { createTrackedApprover, listApprovals, decideApproval, findApproval } from './web/web-approver.js';
 export { scaffoldAgent, scaffoldSubagent, AgentNameError, AgentExistsError, AgentNotFoundError, AgentModelError } from './bin/cli.js';

package/dist/index.js

@@ -68,6 +68,6 @@ export { listDeclaredEnvVars, setEnvVar, unsetEnvVar, setAgentEnvVar, unsetAgent
 export { readActauthConfig, addActauthRule, updateActauthRule, removeActauthRule, setDefaultDecision, ActauthRuleExistsError, ActauthRuleNotFoundError, } from './web/actauth-admin.js';
 export { installAbility, upgradeAbility, removeAbility, listInstalledAbilities, backfillDependencies, AbilityManifestError, AbilityVersionError, AbilityCollisionError, AbilityAlreadyInstalledError, AbilityNotInstalledError, } from './bin/ability-manager.js';
 export { searchPublicAbilities, fetchLatestAbilityVersion } from './web/abilities-admin.js';
-export { describeModelProviders, describeGateways } from './web/global-config.js';
+export { describeModelProviders, describeGateways, setModelProviderKey, clearModelProviderKey, ModelKeyError } from './web/global-config.js';
 export { createTrackedApprover, listApprovals, decideApproval, findApproval } from './web/web-approver.js';
 export { scaffoldAgent, scaffoldSubagent, AgentNameError, AgentExistsError, AgentNotFoundError, AgentModelError } from './bin/cli.js';

package/dist/web/global-config-page.js

@@ -62,6 +62,11 @@ export const globalConfigPageHtml = `<!doctype html>
     border-color: var(--bad);
   }
   .delete-btn:hover { background: var(--bad-soft); }
+  form.key-form { display: flex; gap: 6px; align-items: center; flex-wrap: wrap; margin: 0; }
+  form.key-form input[type=password] { width: 240px; max-width: 100%; font-family: ui-monospace, monospace; font-size: 12px; }
+  form.key-form button { font-size: 12px; }
+  .key-msg { font-size: 11px; margin-top: 4px; }
+  .key-msg.bad { color: var(--bad); }
 </style>
 </head>
 <body data-le-page="config">
@@ -70,7 +75,7 @@ ${consoleSidebarHtml}
 <main class="le-main">
   <div class="section-panel" data-section-panel="models" style="display:contents">
     <div class="le-head plain"><div class="le-title"><button type="button" class="le-menu-btn" data-le-menu aria-label="Open navigation">&#9776;</button>
-      <div><h1>Models</h1><p>Which model providers have an API key set, and which agents use each one.</p></div></div></div>
+      <div><h1>Models</h1><p>API keys for each model provider, and which agents use each one. A saved key is stored on this server and never shown again.</p></div></div></div>
     <div class="le-scroll"><div class="le-page" style="display:block"><div id="modelsContent"><p class="hint">Loading&hellip;</p></div></div></div>
   </div>
   <div class="section-panel" data-section-panel="gateways" style="display:none">
@@ -102,9 +107,19 @@ ${consoleShellScript}
 
   function renderModels(data) {
     var providerRows = data.providers.map(function (p) {
+      // Write-only: the field is always empty; the server never sends a
+      // key back, only whether one is set.
+      var keyCell = data.canSave
+        ? '<form class="key-form" data-provider="' + escapeHtml(p.provider) + '">' +
+            '<input type="password" name="key" autocomplete="off" spellcheck="false" placeholder="' + (p.configured ? 'Paste a new key to replace it' : 'Paste API key') + '" aria-label="' + escapeHtml(p.provider) + ' API key">' +
+            '<button type="submit">Save</button>' +
+            (p.configured ? '<button type="button" class="delete-btn" data-remove-key="' + escapeHtml(p.provider) + '">Remove</button>' : '') +
+          '</form><div class="key-msg" data-key-msg="' + escapeHtml(p.provider) + '"></div>'
+        : '<span class="hint">Set LOOPENGINE_ADMIN_AUTH to manage keys here, or put ' + escapeHtml(p.envVar) + ' in .env.</span>';
       return '<tr><td><code>' + escapeHtml(p.provider) + '</code></td>' +
         '<td><code>' + escapeHtml(p.envVar) + '</code></td>' +
-        '<td>' + badge(p.configured, 'configured', 'not set') + '</td></tr>';
+        '<td>' + badge(p.configured, 'configured', 'not set') + '</td>' +
+        '<td>' + keyCell + '</td></tr>';
     }).join('');
 
     var agentRows = data.agents.length
@@ -116,13 +131,59 @@ ${consoleShellScript}
       : '<tr><td colspan="3"><p class="hint">No agents with a resolved model config (a custom createModelCall has nothing to report here).</p></td></tr>';
 
     return '<section><h3>Providers</h3>' +
-        '<table><thead><tr><th>Provider</th><th>Env var</th><th>Status</th></tr></thead><tbody>' + providerRows + '</tbody></table>' +
+        '<table><thead><tr><th>Provider</th><th>Env var</th><th>Status</th><th>Key</th></tr></thead><tbody>' + providerRows + '</tbody></table>' +
       '</section>' +
       '<section><h3>Agents</h3>' +
         '<table><thead><tr><th>Agent</th><th>Provider</th><th>Model</th></tr></thead><tbody>' + agentRows + '</tbody></table>' +
       '</section>';
   }
 
+  function keyMessage(provider, text, bad) {
+    var el = document.querySelector('[data-key-msg="' + provider + '"]');
+    if (!el) return;
+    el.textContent = text;
+    el.className = 'key-msg' + (bad ? ' bad' : '');
+  }
+
+  function sendKey(provider, method, body) {
+    keyMessage(provider, method === 'PUT' ? 'Saving' + String.fromCharCode(8230) : 'Removing' + String.fromCharCode(8230), false);
+    return fetch('/config/models/' + encodeURIComponent(provider) + '/key', {
+      method: method,
+      headers: body ? { 'content-type': 'application/json' } : {},
+      body: body ? JSON.stringify(body) : undefined,
+    })
+      .then(function (r) { return r.json().then(function (j) { return { ok: r.ok, body: j }; }); })
+      .then(function (r) {
+        if (!r.ok) throw new Error(r.body.error || 'request failed');
+        loadModels();
+      })
+      .catch(function (err) { keyMessage(provider, err.message, true); });
+  }
+
+  document.getElementById('modelsContent').addEventListener('submit', function (ev) {
+    var form = ev.target.closest('form.key-form');
+    if (!form) return;
+    ev.preventDefault();
+    var input = form.querySelector('input[name=key]');
+    var key = input.value.trim();
+    if (!key) { keyMessage(form.getAttribute('data-provider'), 'Paste a key first.', true); return; }
+    // Cleared at once, so the key doesn't sit in the page while saving.
+    input.value = '';
+    sendKey(form.getAttribute('data-provider'), 'PUT', { key: key });
+  });
+
+  document.getElementById('modelsContent').addEventListener('click', function (ev) {
+    var btn = ev.target.closest('[data-remove-key]');
+    if (!btn) return;
+    var provider = btn.getAttribute('data-remove-key');
+    if (btn.getAttribute('data-armed') !== '1') {
+      btn.setAttribute('data-armed', '1');
+      btn.textContent = 'Remove ' + provider + ' key?';
+      return;
+    }
+    sendKey(provider, 'DELETE');
+  });
+
   function loadModels() {
     var content = document.getElementById('modelsContent');
     fetch('/config/models')

package/dist/web/global-config.d.ts

@@ -13,6 +13,8 @@ export interface ModelsView {
     providers: ModelProviderInfo[];
     agents: AgentModelUsage[];
 }
+export declare class ModelKeyError extends Error {
+}
 /** Every registered agent's resolved model, alongside whether each
  * supported provider actually has credentials available in this
  * process's environment — an operator's first question when a request
@@ -55,3 +57,15 @@ export interface GatewaysView {
  * shown so the Gateways panel isn't silently missing them, not because
  * there's anything to check for them yet. */
 export declare function describeGateways(cliCommand?: string): Promise<GatewaysView>;
+/** The env var a provider's key lives in, or undefined for an unknown
+ * provider. */
+export declare function modelKeyEnvVar(provider: string): string | undefined;
+/**
+ * Saves a provider's API key from the console's Models page, through the
+ * same secret store as the Environment tab (the project's .env by
+ * default), and applies it to this process, so the next model call uses
+ * it without a restart. Write-only: nothing here or in describeModelProviders
+ * ever returns a key, only whether one is set.
+ */
+export declare function setModelProviderKey(provider: string, key: unknown): Promise<void>;
+export declare function clearModelProviderKey(provider: string): Promise<void>;

package/dist/web/global-config.js

@@ -1,4 +1,7 @@
 import { getComposioAuthStatus } from '../core/gateway-tools.js';
+import { setEnvVar, unsetEnvVar } from './env-admin.js';
+export class ModelKeyError extends Error {
+}
 // One entry per provider agent-config.ts's own AgentModelConfig union
 // actually supports (see its own doc comment) — kept here, not derived
 // from that type, since there's no runtime list to introspect a TS
@@ -70,3 +73,32 @@ export async function describeGateways(cliCommand = 'composio') {
         ],
     };
 }
+/** The env var a provider's key lives in, or undefined for an unknown
+ * provider. */
+export function modelKeyEnvVar(provider) {
+    return KNOWN_PROVIDERS.find((p) => p.provider === provider)?.envVar;
+}
+/**
+ * Saves a provider's API key from the console's Models page, through the
+ * same secret store as the Environment tab (the project's .env by
+ * default), and applies it to this process, so the next model call uses
+ * it without a restart. Write-only: nothing here or in describeModelProviders
+ * ever returns a key, only whether one is set.
+ */
+export async function setModelProviderKey(provider, key) {
+    const envVar = modelKeyEnvVar(provider);
+    if (!envVar)
+        throw new ModelKeyError(`unknown provider '${provider}'`);
+    const value = typeof key === 'string' ? key.trim() : '';
+    // Keys are single tokens; whitespace inside one is a paste mistake.
+    if (value.length < 8 || value.length > 500 || /\s/.test(value)) {
+        throw new ModelKeyError('That doesn\'t look like an API key: paste the whole key, with no spaces or line breaks.');
+    }
+    await setEnvVar(envVar, value);
+}
+export async function clearModelProviderKey(provider) {
+    const envVar = modelKeyEnvVar(provider);
+    if (!envVar)
+        throw new ModelKeyError(`unknown provider '${provider}'`);
+    await unsetEnvVar(envVar);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loopengine",
-  "version": "0.1.72",
+  "version": "0.1.74",
   "type": "module",
   "description": "Runtime for tool-using AI agents with a transparent ReAct loop.",
   "license": "MIT",