loopengine 0.1.73 → 0.1.75

package/dist/core/discover-agents.d.ts

@@ -5,26 +5,6 @@ export interface AgentModule {
     /** Factory, not a shared instance — a fresh ModelCall per request/session. */
     createModelCall: () => ModelCall;
 }
-/** Builds a lazy, memoized createModelCall from AgentConfig.model, for a
- * module that doesn't export its own — see that field's own doc comment.
- * The provider's SDK module is imported here, eagerly, but that's cheap
- * and safe with no API key at all: importing model-calls/*.ts only
- * defines functions, it never constructs a client at module top level
- * (see e.g. createAnthropicModelCall's own body) — so this can't fail
- * discovery the way eagerly building the actual client would. The real
- * client is only built the first time the returned function is actually
- * called, and reused after that, the same "don't crash the whole server
- * over one agent's missing API key, don't rebuild per call" reasoning
- * agents/customer-service/index.ts's own hand-written createModelCall
- * used before this existed.
- *
- * Exported so a caller updating an *already-registered* agent's model
- * (see agent-file-admin.ts's editAgentFile, applied live via
- * core/agent-registry.ts's updateAgent) can rebuild just this one closure
- * without re-importing the whole module — Node's ESM loader caches an
- * already-imported module forever, so there's no supported way to
- * re-import a changed agent file's own createModelCall directly; this is
- * the one piece of it that's meaningfully regenerable on its own. */
 export declare function synthesizeCreateModelCall(model: AgentModelConfig): Promise<() => ModelCall>;
 /** Imports one agent module at `path` and resolves it to an AgentModule —
  * the single-file version of what discoverAgents does over a whole

package/dist/core/discover-agents.js

@@ -37,30 +37,55 @@ function isRawAgentModule(mod) {
  * already-imported module forever, so there's no supported way to
  * re-import a changed agent file's own createModelCall directly; this is
  * the one piece of it that's meaningfully regenerable on its own. */
+// The env var each provider's key defaults to (same names as
+// web/global-config.ts's Models page).
+const PROVIDER_KEY_ENV = {
+    anthropic: 'ANTHROPIC_API_KEY',
+    openai: 'OPENAI_API_KEY',
+    deepseek: 'DEEPSEEK_API_KEY',
+    kimi: 'MOONSHOT_API_KEY',
+    glm: 'GLM_API_KEY',
+    gemini: 'GEMINI_API_KEY',
+};
 export async function synthesizeCreateModelCall(model) {
-    let cached;
+    let build;
     if (model.provider === 'anthropic') {
         const { createAnthropicModelCall } = await import('./model-calls/anthropic-model-call.js');
-        return () => (cached ??= createAnthropicModelCall(model));
+        build = () => createAnthropicModelCall(model);
     }
-    if (model.provider === 'openai') {
+    else if (model.provider === 'openai') {
         const { createOpenAIModelCall } = await import('./model-calls/openai-model-call.js');
-        return () => (cached ??= createOpenAIModelCall(model));
+        build = () => createOpenAIModelCall(model);
     }
-    if (model.provider === 'deepseek') {
+    else if (model.provider === 'deepseek') {
         const { createDeepSeekModelCall } = await import('./model-calls/deepseek-model-call.js');
-        return () => (cached ??= createDeepSeekModelCall(model));
+        build = () => createDeepSeekModelCall(model);
     }
-    if (model.provider === 'kimi') {
+    else if (model.provider === 'kimi') {
         const { createKimiModelCall } = await import('./model-calls/kimi-model-call.js');
-        return () => (cached ??= createKimiModelCall(model));
+        build = () => createKimiModelCall(model);
     }
-    if (model.provider === 'glm') {
+    else if (model.provider === 'glm') {
         const { createGlmModelCall } = await import('./model-calls/glm-model-call.js');
-        return () => (cached ??= createGlmModelCall(model));
+        build = () => createGlmModelCall(model);
+    }
+    else {
+        const { createGeminiModelCall } = await import('./model-calls/gemini-model-call.js');
+        build = () => createGeminiModelCall(model);
     }
-    const { createGeminiModelCall } = await import('./model-calls/gemini-model-call.js');
-    return () => (cached ??= createGeminiModelCall(model));
+    // Rebuilt when the key it was built with changes, so a key saved or
+    // replaced on the console's Models page applies to the next call
+    // without a restart. An explicit `apiKey` in the config never changes.
+    let cached;
+    let cachedKey;
+    return () => {
+        const key = model.apiKey ?? process.env[PROVIDER_KEY_ENV[model.provider]];
+        if (!cached || key !== cachedKey) {
+            cached = build();
+            cachedKey = key;
+        }
+        return cached;
+    };
 }
 /** Resolves one directory entry to an agent module's path, or undefined if
  * this entry isn't one — a `.ts`/`.js` file directly (the common case), or

package/dist/core/secret-store.js

@@ -5,7 +5,7 @@
 // self-hosted install has always used. A host that keeps secrets
 // somewhere else (a hosted control plane's vault, Vault, a cloud secret
 // manager) swaps it in once at startup with setSecretStore().
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { parseEnv } from 'node:util';
 export function agentEnvFilePath(dir) {
@@ -72,7 +72,13 @@ function upsertEnvFileLine(path, name, value) {
     else {
         lines[existingIndex] = newLine;
     }
-    writeFileSync(path, lines.join('\n') + '\n');
+    writeEnvFile(path, lines.join('\n') + '\n');
+}
+/** .env files hold secrets: owner-only (0600), including one that
+ * already existed with wider permissions. */
+function writeEnvFile(path, content) {
+    writeFileSync(path, content, { mode: 0o600 });
+    chmodSync(path, 0o600);
 }
 /** Removes NAME= from the .env file at `path`, if present. Only
  * rewrites the file when something actually changed — a no-op removal
@@ -84,7 +90,7 @@ function removeEnvFileLine(path, name) {
     const lines = readFileSync(path, 'utf8').split('\n');
     const filtered = lines.filter((line) => !line.startsWith(`${name}=`));
     if (filtered.length !== lines.length)
-        writeFileSync(path, filtered.join('\n').replace(/\n*$/, '\n'));
+        writeEnvFile(path, filtered.join('\n').replace(/\n*$/, '\n'));
 }
 /** The project's .env for shared values, agents/<name>/.env for each
  * agent's own — the default, and what every self-hosted install uses. */

package/dist/core/trusted-proxy.d.ts

@@ -4,6 +4,12 @@ export interface ProxyIdentity {
     sub: string;
     workspace?: string;
     role: string;
+    /** The person's email, when the proxy knows it (shown in the console's
+     * sidebar). */
+    email?: string;
+    /** Where the person manages this workspace on the host, shown as the
+     * console's "Dashboard" link. */
+    dashboardUrl?: string;
     /** Expiry, Unix seconds. */
     exp: number;
 }

package/dist/core/version.d.ts

@@ -0,0 +1 @@
+export declare function loopengineVersion(): string;

package/dist/core/version.js

@@ -0,0 +1,24 @@
+// The installed loopengine version, for the console's Settings section.
+// package.json sits one level above core/ in this repo, and two above
+// dist/core/ in the published package (dist/package.json is only the
+// module-resolution stub the build writes, with no version).
+import { existsSync, readFileSync } from 'node:fs';
+let cached;
+export function loopengineVersion() {
+    if (cached)
+        return cached;
+    for (const rel of ['../package.json', '../../package.json']) {
+        const url = new URL(rel, import.meta.url);
+        if (!existsSync(url))
+            continue;
+        try {
+            const pkg = JSON.parse(readFileSync(url, 'utf8'));
+            if (pkg.name === 'loopengine' && pkg.version)
+                return (cached = pkg.version);
+        }
+        catch {
+            // Not loopengine's package.json; try the next.
+        }
+    }
+    return (cached = 'unknown');
+}

package/dist/index.d.ts

@@ -77,7 +77,8 @@ export { installAbility, upgradeAbility, removeAbility, listInstalledAbilities,
 export type { InstalledAbilityRecord, AbilityEnvDecl, UpgradeFileResult } from './bin/ability-manager.js';
 export { searchPublicAbilities, fetchLatestAbilityVersion } from './web/abilities-admin.js';
 export type { PublicAbilitySearchResult } from './web/abilities-admin.js';
-export { describeModelProviders, describeGateways } from './web/global-config.js';
+export { describeModelProviders, describeGateways, setModelProviderKey, clearModelProviderKey, ModelKeyError } from './web/global-config.js';
+export { loopengineVersion } from './core/version.js';
 export type { ModelProviderInfo, AgentModelUsage, ModelsView, GatewayProviderInfo, GatewaysView } from './web/global-config.js';
 export { createTrackedApprover, listApprovals, decideApproval, findApproval } from './web/web-approver.js';
 export { scaffoldAgent, scaffoldSubagent, AgentNameError, AgentExistsError, AgentNotFoundError, AgentModelError } from './bin/cli.js';

package/dist/index.js

@@ -68,6 +68,7 @@ export { listDeclaredEnvVars, setEnvVar, unsetEnvVar, setAgentEnvVar, unsetAgent
 export { readActauthConfig, addActauthRule, updateActauthRule, removeActauthRule, setDefaultDecision, ActauthRuleExistsError, ActauthRuleNotFoundError, } from './web/actauth-admin.js';
 export { installAbility, upgradeAbility, removeAbility, listInstalledAbilities, backfillDependencies, AbilityManifestError, AbilityVersionError, AbilityCollisionError, AbilityAlreadyInstalledError, AbilityNotInstalledError, } from './bin/ability-manager.js';
 export { searchPublicAbilities, fetchLatestAbilityVersion } from './web/abilities-admin.js';
-export { describeModelProviders, describeGateways } from './web/global-config.js';
+export { describeModelProviders, describeGateways, setModelProviderKey, clearModelProviderKey, ModelKeyError } from './web/global-config.js';
+export { loopengineVersion } from './core/version.js';
 export { createTrackedApprover, listApprovals, decideApproval, findApproval } from './web/web-approver.js';
 export { scaffoldAgent, scaffoldSubagent, AgentNameError, AgentExistsError, AgentNotFoundError, AgentModelError } from './bin/cli.js';

package/dist/web/console-shell.js

@@ -25,6 +25,8 @@ export const consoleSidebarHtml = `<aside class="le-sidebar" aria-label="Console
   <nav class="le-foot" aria-label="Settings">
     <a href="/config?section=models" data-le-nav="models">Models</a>
     <a href="/config?section=gateways" data-le-nav="integrations">Integrations</a>
+    <a href="/config?section=settings" data-le-nav="settings">Settings</a>
+    <div class="le-who" id="leWho" hidden></div>
   </nav>
 </aside>`;
 export const consoleShellScript = `<script>
@@ -156,12 +158,33 @@ export const consoleShellScript = `<script>
     renderList();
   }
 
-  var foot = page === 'config' ? (params.get('section') === 'gateways' ? 'integrations' : 'models') : '';
+  var section = params.get('section');
+  var foot = page === 'config' ? (section === 'gateways' ? 'integrations' : section === 'settings' ? 'settings' : 'models') : '';
   var footLinks = document.querySelectorAll('[data-le-nav]');
   for (var i = 0; i < footLinks.length; i++) {
     if (footLinks[i].getAttribute('data-le-nav') === foot) footLinks[i].setAttribute('aria-current', 'page');
   }
 
+  // Who is signed in: the email and a link back to the dashboard when a
+  // hosting router signs requests, otherwise how this server is protected.
+  var who = document.getElementById('leWho');
+  if (who) {
+    fetch('/config/settings')
+      .then(function (r) { return r.ok ? r.json() : null; })
+      .then(function (s) {
+        if (!s || !s.signIn) return;
+        var si = s.signIn;
+        if (si.mode === 'hosted') {
+          who.innerHTML = '<span class="le-who-name" title="' + esc(si.email || '') + '">' + esc(si.email || 'Signed in') + '</span>' +
+            (si.dashboardUrl ? '<a href="' + esc(si.dashboardUrl) + '">Dashboard</a>' : '');
+        } else {
+          who.innerHTML = '<span class="le-who-name">' + (si.mode === 'basic' ? 'Signed in with Basic Auth' : 'No sign-in configured') + '</span>';
+        }
+        who.hidden = false;
+      })
+      .catch(function () {});
+  }
+
   document.addEventListener('click', function (ev) {
     if (!app) return;
     if (ev.target.closest('[data-le-menu]')) { app.classList.toggle('nav-open'); return; }

package/dist/web/dev-ui-styles.js

@@ -130,6 +130,11 @@ export const devUiCss = `
   .le-foot a { padding: 7px 8px; border-radius: 6px; color: var(--ink-muted); text-decoration: none; }
   .le-foot a:hover { background: var(--surface-2); color: var(--ink); }
   .le-foot a[aria-current="page"] { background: var(--accent-soft); color: var(--ink); }
+  .le-who { padding: 10px 8px 4px; font-size: 12px; color: var(--ink-faint); display: flex; justify-content: space-between; align-items: center; gap: 8px; min-width: 0; }
+  .le-who[hidden] { display: none; }
+  .le-who-name { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; min-width: 0; }
+  .le-foot .le-who a { padding: 0; flex: none; color: var(--accent-ink); }
+  .le-foot .le-who a:hover { background: none; text-decoration: underline; }
   .le-main { display: flex; flex-direction: column; min-width: 0; min-height: 0; overflow: hidden; }
   .le-scroll { flex: 1; min-height: 0; overflow-y: auto; }
   .le-page { padding: 24px; max-width: 1100px; display: grid; gap: 24px; }

package/dist/web/global-config-page.js

@@ -62,6 +62,11 @@ export const globalConfigPageHtml = `<!doctype html>
     border-color: var(--bad);
   }
   .delete-btn:hover { background: var(--bad-soft); }
+  form.key-form { display: flex; gap: 6px; align-items: center; flex-wrap: wrap; margin: 0; }
+  form.key-form input[type=password] { width: 240px; max-width: 100%; font-family: ui-monospace, monospace; font-size: 12px; }
+  form.key-form button { font-size: 12px; }
+  .key-msg { font-size: 11px; margin-top: 4px; }
+  .key-msg.bad { color: var(--bad); }
 </style>
 </head>
 <body data-le-page="config">
@@ -70,7 +75,7 @@ ${consoleSidebarHtml}
 <main class="le-main">
   <div class="section-panel" data-section-panel="models" style="display:contents">
     <div class="le-head plain"><div class="le-title"><button type="button" class="le-menu-btn" data-le-menu aria-label="Open navigation">&#9776;</button>
-      <div><h1>Models</h1><p>Which model providers have an API key set, and which agents use each one.</p></div></div></div>
+      <div><h1>Models</h1><p>API keys for each model provider, and which agents use each one. A saved key is stored on this server and never shown again.</p></div></div></div>
     <div class="le-scroll"><div class="le-page" style="display:block"><div id="modelsContent"><p class="hint">Loading&hellip;</p></div></div></div>
   </div>
   <div class="section-panel" data-section-panel="gateways" style="display:none">
@@ -78,6 +83,11 @@ ${consoleSidebarHtml}
       <div><h1>Integrations</h1><p>Outside tool sources (such as Composio) that agents can add tools from.</p></div></div></div>
     <div class="le-scroll"><div class="le-page" style="display:block"><div id="gatewaysContent"><p class="hint">Loading&hellip;</p></div></div></div>
   </div>
+  <div class="section-panel" data-section-panel="settings" style="display:none">
+    <div class="le-head plain"><div class="le-title"><button type="button" class="le-menu-btn" data-le-menu aria-label="Open navigation">&#9776;</button>
+      <div><h1>Settings</h1><p>How this server is set up. These come from its deployment, not from this page.</p></div></div></div>
+    <div class="le-scroll"><div class="le-page" style="display:block"><div id="settingsContent"><p class="hint">Loading&hellip;</p></div></div></div>
+  </div>
 </main>
 </div>
 ${consoleShellScript}
@@ -102,9 +112,19 @@ ${consoleShellScript}
 
   function renderModels(data) {
     var providerRows = data.providers.map(function (p) {
+      // Write-only: the field is always empty; the server never sends a
+      // key back, only whether one is set.
+      var keyCell = data.canSave
+        ? '<form class="key-form" data-provider="' + escapeHtml(p.provider) + '">' +
+            '<input type="password" name="key" autocomplete="off" spellcheck="false" placeholder="' + (p.configured ? 'Paste a new key to replace it' : 'Paste API key') + '" aria-label="' + escapeHtml(p.provider) + ' API key">' +
+            '<button type="submit">Save</button>' +
+            (p.configured ? '<button type="button" class="delete-btn" data-remove-key="' + escapeHtml(p.provider) + '">Remove</button>' : '') +
+          '</form><div class="key-msg" data-key-msg="' + escapeHtml(p.provider) + '"></div>'
+        : '<span class="hint">Set LOOPENGINE_ADMIN_AUTH to manage keys here, or put ' + escapeHtml(p.envVar) + ' in .env.</span>';
       return '<tr><td><code>' + escapeHtml(p.provider) + '</code></td>' +
         '<td><code>' + escapeHtml(p.envVar) + '</code></td>' +
-        '<td>' + badge(p.configured, 'configured', 'not set') + '</td></tr>';
+        '<td>' + badge(p.configured, 'configured', 'not set') + '</td>' +
+        '<td>' + keyCell + '</td></tr>';
     }).join('');
 
     var agentRows = data.agents.length
@@ -116,13 +136,59 @@ ${consoleShellScript}
       : '<tr><td colspan="3"><p class="hint">No agents with a resolved model config (a custom createModelCall has nothing to report here).</p></td></tr>';
 
     return '<section><h3>Providers</h3>' +
-        '<table><thead><tr><th>Provider</th><th>Env var</th><th>Status</th></tr></thead><tbody>' + providerRows + '</tbody></table>' +
+        '<table><thead><tr><th>Provider</th><th>Env var</th><th>Status</th><th>Key</th></tr></thead><tbody>' + providerRows + '</tbody></table>' +
       '</section>' +
       '<section><h3>Agents</h3>' +
         '<table><thead><tr><th>Agent</th><th>Provider</th><th>Model</th></tr></thead><tbody>' + agentRows + '</tbody></table>' +
       '</section>';
   }
 
+  function keyMessage(provider, text, bad) {
+    var el = document.querySelector('[data-key-msg="' + provider + '"]');
+    if (!el) return;
+    el.textContent = text;
+    el.className = 'key-msg' + (bad ? ' bad' : '');
+  }
+
+  function sendKey(provider, method, body) {
+    keyMessage(provider, method === 'PUT' ? 'Saving' + String.fromCharCode(8230) : 'Removing' + String.fromCharCode(8230), false);
+    return fetch('/config/models/' + encodeURIComponent(provider) + '/key', {
+      method: method,
+      headers: body ? { 'content-type': 'application/json' } : {},
+      body: body ? JSON.stringify(body) : undefined,
+    })
+      .then(function (r) { return r.json().then(function (j) { return { ok: r.ok, body: j }; }); })
+      .then(function (r) {
+        if (!r.ok) throw new Error(r.body.error || 'request failed');
+        loadModels();
+      })
+      .catch(function (err) { keyMessage(provider, err.message, true); });
+  }
+
+  document.getElementById('modelsContent').addEventListener('submit', function (ev) {
+    var form = ev.target.closest('form.key-form');
+    if (!form) return;
+    ev.preventDefault();
+    var input = form.querySelector('input[name=key]');
+    var key = input.value.trim();
+    if (!key) { keyMessage(form.getAttribute('data-provider'), 'Paste a key first.', true); return; }
+    // Cleared at once, so the key doesn't sit in the page while saving.
+    input.value = '';
+    sendKey(form.getAttribute('data-provider'), 'PUT', { key: key });
+  });
+
+  document.getElementById('modelsContent').addEventListener('click', function (ev) {
+    var btn = ev.target.closest('[data-remove-key]');
+    if (!btn) return;
+    var provider = btn.getAttribute('data-remove-key');
+    if (btn.getAttribute('data-armed') !== '1') {
+      btn.setAttribute('data-armed', '1');
+      btn.textContent = 'Remove ' + provider + ' key?';
+      return;
+    }
+    sendKey(provider, 'DELETE');
+  });
+
   function loadModels() {
     var content = document.getElementById('modelsContent');
     fetch('/config/models')
@@ -216,6 +282,42 @@ ${consoleShellScript}
       });
   }
 
+  // ---- Settings section ----
+
+  function renderSettings(d) {
+    var si = d.signIn || {};
+    var signIn = si.mode === 'hosted'
+      ? 'Managed by your LoopEngine Cloud account' + (si.email ? ' (' + escapeHtml(si.email) + ')' : '') +
+        (si.dashboardUrl ? ' &middot; <a href="' + escapeHtml(si.dashboardUrl) + '">Dashboard</a>' : '')
+      : si.mode === 'basic'
+        ? 'Basic Auth (<code>LOOPENGINE_ADMIN_AUTH</code>)'
+        : '<span class="error">None: anyone who can reach this server can use it. Set <code>LOOPENGINE_ADMIN_AUTH</code>.</span>';
+    var rows = [
+      ['Admin sign-in', signIn],
+      ['LoopEngine version', '<code>' + escapeHtml(d.version) + '</code>'],
+      ['Environment name', '<code>' + escapeHtml(d.environment) + '</code> <span class="hint">(LOOPENGINE_ENV)</span>'],
+      ['Public address', d.publicUrl ? '<code>' + escapeHtml(d.publicUrl) + '</code>' : '<span class="hint">Not set (LOOPENGINE_PUBLIC_URL); links in notifications use the address saved with each notifier</span>'],
+      ['Scheduled tasks', d.scheduler === 'off' ? 'Off on this server (LOOPENGINE_SCHEDULER=off)' : 'Run by this server'],
+      ['Theme', 'Follows your system'],
+    ];
+    return '<section><table><thead><tr><th>Setting</th><th>Value</th></tr></thead><tbody>' +
+      rows.map(function (r) { return '<tr><td>' + r[0] + '</td><td>' + r[1] + '</td></tr>'; }).join('') +
+      '</tbody></table></section>';
+  }
+
+  function loadSettings() {
+    var content = document.getElementById('settingsContent');
+    fetch('/config/settings')
+      .then(function (r) { return r.json(); })
+      .then(function (d) {
+        content.innerHTML = renderSettings(d);
+        loadedSections.settings = true;
+      })
+      .catch(function (err) {
+        content.innerHTML = '<p class="error">Could not load settings: ' + escapeHtml(err.message) + '</p>';
+      });
+  }
+
   // ---- Section switching ----
 
   function switchSection(section) {
@@ -229,6 +331,7 @@ ${consoleShellScript}
     }
     if (section === 'models' && !loadedSections.models) loadModels();
     if (section === 'gateways' && !loadedSections.gateways) loadGateways();
+    if (section === 'settings' && !loadedSections.settings) loadSettings();
   }
 
   for (var i = 0; i < sectionButtons.length; i++) {
@@ -240,7 +343,7 @@ ${consoleShellScript}
   // real section, same "trust the query param only if it's valid"
   // caution playground.ts's own ?agent= handling already uses.
   var requestedSection = new URLSearchParams(location.search).get('section');
-  var initialSection = requestedSection === 'gateways' || requestedSection === 'models' ? requestedSection : currentSection;
+  var initialSection = requestedSection === 'gateways' || requestedSection === 'models' || requestedSection === 'settings' ? requestedSection : currentSection;
   switchSection(initialSection);
 })();
 </script>

package/dist/web/global-config.d.ts

@@ -13,6 +13,8 @@ export interface ModelsView {
     providers: ModelProviderInfo[];
     agents: AgentModelUsage[];
 }
+export declare class ModelKeyError extends Error {
+}
 /** Every registered agent's resolved model, alongside whether each
  * supported provider actually has credentials available in this
  * process's environment — an operator's first question when a request
@@ -55,3 +57,15 @@ export interface GatewaysView {
  * shown so the Gateways panel isn't silently missing them, not because
  * there's anything to check for them yet. */
 export declare function describeGateways(cliCommand?: string): Promise<GatewaysView>;
+/** The env var a provider's key lives in, or undefined for an unknown
+ * provider. */
+export declare function modelKeyEnvVar(provider: string): string | undefined;
+/**
+ * Saves a provider's API key from the console's Models page, through the
+ * same secret store as the Environment tab (the project's .env by
+ * default), and applies it to this process, so the next model call uses
+ * it without a restart. Write-only: nothing here or in describeModelProviders
+ * ever returns a key, only whether one is set.
+ */
+export declare function setModelProviderKey(provider: string, key: unknown): Promise<void>;
+export declare function clearModelProviderKey(provider: string): Promise<void>;

package/dist/web/global-config.js

@@ -1,4 +1,7 @@
 import { getComposioAuthStatus } from '../core/gateway-tools.js';
+import { setEnvVar, unsetEnvVar } from './env-admin.js';
+export class ModelKeyError extends Error {
+}
 // One entry per provider agent-config.ts's own AgentModelConfig union
 // actually supports (see its own doc comment) — kept here, not derived
 // from that type, since there's no runtime list to introspect a TS
@@ -70,3 +73,32 @@ export async function describeGateways(cliCommand = 'composio') {
         ],
     };
 }
+/** The env var a provider's key lives in, or undefined for an unknown
+ * provider. */
+export function modelKeyEnvVar(provider) {
+    return KNOWN_PROVIDERS.find((p) => p.provider === provider)?.envVar;
+}
+/**
+ * Saves a provider's API key from the console's Models page, through the
+ * same secret store as the Environment tab (the project's .env by
+ * default), and applies it to this process, so the next model call uses
+ * it without a restart. Write-only: nothing here or in describeModelProviders
+ * ever returns a key, only whether one is set.
+ */
+export async function setModelProviderKey(provider, key) {
+    const envVar = modelKeyEnvVar(provider);
+    if (!envVar)
+        throw new ModelKeyError(`unknown provider '${provider}'`);
+    const value = typeof key === 'string' ? key.trim() : '';
+    // Keys are single tokens; whitespace inside one is a paste mistake.
+    if (value.length < 8 || value.length > 500 || /\s/.test(value)) {
+        throw new ModelKeyError('That doesn\'t look like an API key: paste the whole key, with no spaces or line breaks.');
+    }
+    await setEnvVar(envVar, value);
+}
+export async function clearModelProviderKey(provider) {
+    const envVar = modelKeyEnvVar(provider);
+    if (!envVar)
+        throw new ModelKeyError(`unknown provider '${provider}'`);
+    await unsetEnvVar(envVar);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loopengine",
-  "version": "0.1.73",
+  "version": "0.1.75",
   "type": "module",
   "description": "Runtime for tool-using AI agents with a transparent ReAct loop.",
   "license": "MIT",
@@ -26,6 +26,8 @@
     "dist/bin/ability-manager.js",
     "dist/bin/ability-manager.d.ts",
     "dist/core/run-agent.js",
+    "dist/core/version.js",
+    "dist/core/version.d.ts",
     "dist/core/run-agent.d.ts",
     "dist/core/known-urls.js",
     "dist/core/known-urls.d.ts",