loopengine 0.1.8 → 0.1.10

package/dist/index.d.ts

@@ -33,7 +33,7 @@ export { listQuestions, answerQuestion as resolvePendingQuestion, findQuestion,
 export type { PendingQuestion } from './core/system-tools/index.js';
 export { editAgentFile, AgentEditNotSupportedError, AgentFileNotFoundError } from './web/agent-file-admin.js';
 export type { AgentEditableFields, AgentEditResult } from './web/agent-file-admin.js';
-export { createHttpTool, HttpToolNameError, HttpToolExistsError, HttpToolIndexShapeError } from './web/http-tool-admin.js';
+export { createHttpTool, updateHttpTool, readHttpToolSpec, listEditableHttpToolNames, HttpToolNameError, HttpToolExistsError, HttpToolIndexShapeError, HttpToolNotFoundError, HttpToolNotEditableError, } from './web/http-tool-admin.js';
 export type { HttpToolSpec, HttpToolField } from './web/http-tool-admin.js';
 export { agentsConfigPageHtml } from './web/agents-config-page.js';
 export { agentsListPageHtml } from './web/agents-list-page.js';

package/dist/index.js

@@ -37,7 +37,7 @@ export { WebhookNotifier } from './core/http-notify-triggers/webhook.js';
 // question in-process, aliased to avoid colliding with that name.
 export { listQuestions, answerQuestion as resolvePendingQuestion, findQuestion, createAskUserTool } from './core/system-tools/index.js';
 export { editAgentFile, AgentEditNotSupportedError, AgentFileNotFoundError } from './web/agent-file-admin.js';
-export { createHttpTool, HttpToolNameError, HttpToolExistsError, HttpToolIndexShapeError } from './web/http-tool-admin.js';
+export { createHttpTool, updateHttpTool, readHttpToolSpec, listEditableHttpToolNames, HttpToolNameError, HttpToolExistsError, HttpToolIndexShapeError, HttpToolNotFoundError, HttpToolNotEditableError, } from './web/http-tool-admin.js';
 export { agentsConfigPageHtml } from './web/agents-config-page.js';
 export { agentsListPageHtml } from './web/agents-list-page.js';
 export { globalConfigPageHtml } from './web/global-config-page.js';

package/dist/web/agents-config-page.js

@@ -581,6 +581,28 @@ export const agentsConfigPageHtml = `<!doctype html>
     return '<table><thead><tr><th>Name</th><th>Description</th><th>Parallel-safe</th></tr></thead><tbody>' + rows + '</tbody></table>';
   }
 
+  // Local tools' own table, unlike renderTools above (shared by Agent as
+  // Tools, which has nothing editable through this UI) — adds an Actions
+  // column with an Edit button, but only for tools describeAgent flagged
+  // httpToolEditable: those created through this same Tools tab's HTTP
+  // tool builder (web/http-tool-admin.ts's own sidecar spec file is what
+  // that flag is actually derived from). A hand-written tools/<name>.ts
+  // has no spec to repopulate an edit form from, so it just gets a blank
+  // cell — not a button that would 404 the moment it's clicked.
+  function renderLocalTools(tools) {
+    if (!tools.length) return '<p class="muted">No tools.</p>';
+    var rows = tools.map(function (t) {
+      var actions = t.httpToolEditable
+        ? '<button type="button" class="edit-http-tool-btn" data-name="' + escapeHtml(t.name) + '">Edit</button>'
+        : '';
+      return '<tr><td><code>' + escapeHtml(t.name) + '</code></td>' +
+        '<td>' + escapeHtml(t.description) + '</td>' +
+        '<td>' + (t.safe ? 'yes' : 'no') + '</td>' +
+        '<td>' + actions + '</td></tr>';
+    }).join('');
+    return '<table><thead><tr><th>Name</th><th>Description</th><th>Parallel-safe</th><th></th></tr></thead><tbody>' + rows + '</tbody></table>';
+  }
+
   // Overview's own tools table, unlike the Tools tab's three separately-
   // headed sections (Local tools / Gateway Tools / Agent as Tools), is
   // one flat list (cfg.tools) — without a Type column there's no way to
@@ -1474,8 +1496,8 @@ export const agentsConfigPageHtml = `<!doctype html>
   // describeGatewayTools), a real cost not worth paying up front. ----
 
   function renderToolsTabHtml(cfg) {
-    return '<section><h3>Local tools (' + cfg.localTools.length + ')</h3>' + renderTools(cfg.localTools) +
-      '<div class="admin-subsection"><h4>Create an HTTP tool</h4>' + renderHttpToolFormHtml() + '</div>' +
+    return '<section><h3>Local tools (' + cfg.localTools.length + ')</h3>' + renderLocalTools(cfg.localTools) +
+      '<div class="admin-subsection"><h4 id="httpToolFormHeading">Create an HTTP tool</h4>' + renderHttpToolFormHtml() + '</div>' +
       '</section>' +
       '<section id="gatewayToolsSection">' +
         '<h3>Gateway Tools <button type="button" id="gatewayToolsRefreshBtn" class="hint-btn">Refresh</button></h3>' +
@@ -1521,7 +1543,7 @@ export const agentsConfigPageHtml = `<!doctype html>
     httpToolHeaderRowCount = 0;
     return '<form class="add-source" id="httpToolForm">' +
       '<label>Name <span class="hint">(snake_case, e.g. lookup_order_status)</span>' +
-        '<input type="text" name="name" required pattern="[a-z][a-z0-9_]*" placeholder="lookup_order_status">' +
+        '<input type="text" name="name" id="httpToolNameInput" required pattern="[a-z][a-z0-9_]*" placeholder="lookup_order_status">' +
       '</label>' +
       '<label>Description' +
         '<textarea name="description" id="httpToolDescriptionInput" required placeholder="What this tool does"></textarea>' +
@@ -1547,10 +1569,11 @@ export const agentsConfigPageHtml = `<!doctype html>
         '<button type="button" id="httpToolAddHeaderBtn" class="hint-btn">Add header</button>' +
       '</label>' +
       '<label class="http-tool-inline-label"><input type="checkbox" name="sendFieldsAsJsonBody"> Send fields as a JSON body (POST/PUT/PATCH only)</label>' +
+      '<label class="http-tool-inline-label"><input type="checkbox" name="safe"> Parallel-safe <span class="hint">(read-only, no side effects &mdash; safe to run alongside other calls)</span></label>' +
       '<label>Response JSON path <span class="hint">(optional &mdash; e.g. data.status; leave blank to return the raw response text)</span>' +
         '<input type="text" name="responseJsonPath" placeholder="data.status">' +
       '</label>' +
-      '<label>Grant permission <span class="hint">(optional &mdash; leave blank to leave this tool at actauth&#39;s own default, typically deny)</span>' +
+      '<label id="httpToolDecisionField">Grant permission <span class="hint">(optional &mdash; leave blank to leave this tool at actauth&#39;s own default, typically deny)</span>' +
         '<select name="decision">' +
           '<option value="">(leave unset)</option>' +
           '<option value="allow">allow</option>' +
@@ -1559,6 +1582,7 @@ export const agentsConfigPageHtml = `<!doctype html>
         '</select>' +
       '</label>' +
       '<button type="submit" id="httpToolSubmitBtn">Create tool</button>' +
+      '<button type="button" id="httpToolCancelBtn" style="display:none">Cancel</button>' +
       '<div id="httpToolError" class="error"></div>' +
       '</form>';
   }
@@ -1580,6 +1604,15 @@ export const agentsConfigPageHtml = `<!doctype html>
     var addHeaderBtn = detail.querySelector('#httpToolAddHeaderBtn');
     var errorEl = detail.querySelector('#httpToolError');
     var submitBtn = detail.querySelector('#httpToolSubmitBtn');
+    var cancelBtn = detail.querySelector('#httpToolCancelBtn');
+    var nameInput = detail.querySelector('#httpToolNameInput');
+    var decisionField = detail.querySelector('#httpToolDecisionField');
+    var headingEl = detail.querySelector('#httpToolFormHeading');
+    // Non-null only while editing an existing tool — the name field is
+    // disabled then (renaming isn't supported, see updateHttpTool's own
+    // doc comment), so the submitted name always has to come from here,
+    // never from the (excluded-from-FormData) disabled input.
+    var editingHttpToolName = null;
 
     addFieldBtn.addEventListener('click', function () {
       fieldRows.insertAdjacentHTML('beforeend', renderHttpToolFieldRow(httpToolFieldRowCount++));
@@ -1590,6 +1623,85 @@ export const agentsConfigPageHtml = `<!doctype html>
       wireHttpToolRemoveButton(headerRows.lastElementChild);
     });
 
+    // Repopulates the (blank, create-mode-shaped) form from a saved spec
+    // — same field/header row-building addFieldBtn/addHeaderBtn already
+    // do, just filled in immediately instead of left blank for typing.
+    function populateHttpToolForm(spec) {
+      nameInput.value = spec.name;
+      form.querySelector('#httpToolDescriptionInput').value = spec.description;
+
+      fieldRows.innerHTML = '';
+      for (var i = 0; i < spec.fields.length; i++) {
+        var f = spec.fields[i];
+        fieldRows.insertAdjacentHTML('beforeend', renderHttpToolFieldRow(httpToolFieldRowCount++));
+        var row = fieldRows.lastElementChild;
+        row.querySelector('.http-tool-field-name').value = f.name;
+        row.querySelector('.http-tool-field-type').value = f.type;
+        row.querySelector('.http-tool-field-description').value = f.description || '';
+        row.querySelector('.http-tool-field-required').checked = f.required;
+        wireHttpToolRemoveButton(row);
+      }
+
+      form.querySelector('[name="method"]').value = spec.method;
+      form.querySelector('[name="url"]').value = spec.url;
+
+      headerRows.innerHTML = '';
+      for (var j = 0; j < spec.headers.length; j++) {
+        var h = spec.headers[j];
+        headerRows.insertAdjacentHTML('beforeend', renderHttpToolHeaderRow(httpToolHeaderRowCount++));
+        var hrow = headerRows.lastElementChild;
+        hrow.querySelector('.http-tool-header-key').value = h.key;
+        hrow.querySelector('.http-tool-header-value').value = h.value;
+        wireHttpToolRemoveButton(hrow);
+      }
+
+      form.querySelector('[name="sendFieldsAsJsonBody"]').checked = spec.sendFieldsAsJsonBody;
+      form.querySelector('[name="safe"]').checked = spec.safe === true;
+      form.querySelector('[name="responseJsonPath"]').value = spec.responseJsonPath || '';
+    }
+
+    function resetHttpToolForm() {
+      form.reset();
+      fieldRows.innerHTML = '';
+      headerRows.innerHTML = '';
+      nameInput.disabled = false;
+      if (headingEl) headingEl.textContent = 'Create an HTTP tool';
+      submitBtn.textContent = 'Create tool';
+      cancelBtn.style.display = 'none';
+      decisionField.style.display = '';
+      errorEl.textContent = '';
+      editingHttpToolName = null;
+    }
+
+    cancelBtn.addEventListener('click', resetHttpToolForm);
+
+    // Local tools table's own Edit buttons (renderLocalTools) — only
+    // present for tools describeAgent flagged httpToolEditable, so this
+    // GET should never actually 404 in normal use.
+    var editButtons = detail.querySelectorAll('.edit-http-tool-btn');
+    for (var k = 0; k < editButtons.length; k++) {
+      editButtons[k].addEventListener('click', function (ev) {
+        var toolName = ev.currentTarget.getAttribute('data-name');
+        errorEl.textContent = '';
+        fetch('/agents/' + encodeURIComponent(name) + '/tools/http/' + encodeURIComponent(toolName))
+          .then(function (r) { return r.json().then(function (j) { return { ok: r.ok, body: j }; }); })
+          .then(function (result) {
+            if (!result.ok) throw new Error(result.body.error || 'request failed');
+            populateHttpToolForm(result.body);
+            nameInput.disabled = true;
+            if (headingEl) headingEl.textContent = 'Edit HTTP tool "' + toolName + '"';
+            submitBtn.textContent = 'Save';
+            cancelBtn.style.display = '';
+            decisionField.style.display = 'none';
+            editingHttpToolName = toolName;
+            form.scrollIntoView({ block: 'nearest' });
+          })
+          .catch(function (err) {
+            errorEl.textContent = 'Could not load tool "' + toolName + '": ' + err.message;
+          });
+      });
+    }
+
     form.addEventListener('submit', function (ev) {
       ev.preventDefault();
       errorEl.textContent = '';
@@ -1619,20 +1731,24 @@ export const agentsConfigPageHtml = `<!doctype html>
 
       var formData = new FormData(form);
       var payload = {
-        name: formData.get('name'),
+        name: editingHttpToolName || formData.get('name'),
         description: formData.get('description'),
         fields: fields,
         method: formData.get('method'),
         url: formData.get('url'),
         headers: headers,
         sendFieldsAsJsonBody: formData.get('sendFieldsAsJsonBody') === 'on',
+        safe: formData.get('safe') === 'on',
         responseJsonPath: formData.get('responseJsonPath') ? formData.get('responseJsonPath') : undefined,
         decision: formData.get('decision') ? formData.get('decision') : undefined,
       };
 
+      var isEdit = !!editingHttpToolName;
+      var url = '/agents/' + encodeURIComponent(name) + '/tools/http' + (isEdit ? '/' + encodeURIComponent(editingHttpToolName) : '');
+
       submitBtn.disabled = true;
-      fetch('/agents/' + encodeURIComponent(name) + '/tools/http', {
-        method: 'POST',
+      fetch(url, {
+        method: isEdit ? 'PUT' : 'POST',
         headers: { 'content-type': 'application/json' },
         body: JSON.stringify(payload),
       })

package/dist/web/http-tool-admin.d.ts

@@ -5,6 +5,10 @@ export declare class HttpToolExistsError extends Error {
 }
 export declare class HttpToolIndexShapeError extends Error {
 }
+export declare class HttpToolNotFoundError extends Error {
+}
+export declare class HttpToolNotEditableError extends Error {
+}
 export interface HttpToolField {
     name: string;
     type: 'string' | 'number' | 'boolean';
@@ -23,6 +27,14 @@ export interface HttpToolSpec {
     }[];
     sendFieldsAsJsonBody: boolean;
     responseJsonPath?: string;
+    /** Same meaning as ToolDefinition.safe (core/agent-config.ts) — true
+     * only for a read-only call with no side effects, so ToolLane can run
+     * it in its parallel lane. Defaults to false/omitted (unsafe) rather
+     * than inferring from `method`, since a GET can still have side
+     * effects (e.g. a webhook-triggering endpoint) and the operator who
+     * knows the real API is in a better position to say than a guess
+     * based on HTTP verb alone. */
+    safe?: boolean;
 }
 /** Generates agents/<agentName>/tools/<spec.name>.ts, registers it in
  * that agent's tools/index.ts, then imports the file it just wrote and
@@ -35,3 +47,26 @@ export declare function createHttpTool(agentName: string, spec: HttpToolSpec): P
     path: string;
     tool: ToolDefinition;
 }>;
+/** Reads back the spec a previous createHttpTool/updateHttpTool call
+ * persisted, for the Tools tab's Edit form to repopulate itself from —
+ * or null if this tool was never created through this module (a
+ * hand-written tools/<name>.ts, or one from before this sidecar existed),
+ * which is exactly the signal the route handler uses to decide whether
+ * to even show an Edit button for it. */
+export declare function readHttpToolSpec(agentName: string, toolName: string): HttpToolSpec | null;
+/** Every tool name in this agent's tools/ dir with a saved spec — i.e.
+ * every tool the Tools tab can offer an Edit button for. Cheap (one
+ * readdirSync), safe to call on every GET /agents/:name/config. */
+export declare function listEditableHttpToolNames(agentName: string): string[];
+/** Overwrites an existing admin-created tool in place — same generated-
+ * code shape createHttpTool produces, just written to the file that's
+ * already there instead of a new one, and without touching tools/index.ts
+ * (the import/export names are unchanged, since renaming isn't supported
+ * here: spec.name must match toolName). Refuses a tool this module didn't
+ * create (no sidecar spec) rather than silently clobbering hand-written
+ * logic — same "refuse rather than guess" rule addToolToIndex's own doc
+ * comment already applies to index.ts. */
+export declare function updateHttpTool(agentName: string, toolName: string, spec: HttpToolSpec): Promise<{
+    path: string;
+    tool: ToolDefinition;
+}>;

package/dist/web/http-tool-admin.js

@@ -21,7 +21,7 @@
 // generated file, or echoed back through the admin API, the same
 // "always env-sourced, never a config literal" rule SendEmail/
 // HttpNotifierConfig's own secrets already follow (core/agent-config.ts).
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { agentDir } from '../core/gateway-tools.js';
@@ -31,6 +31,10 @@ export class HttpToolExistsError extends Error {
 }
 export class HttpToolIndexShapeError extends Error {
 }
+export class HttpToolNotFoundError extends Error {
+}
+export class HttpToolNotEditableError extends Error {
+}
 const TOOL_NAME_PATTERN = /^[a-z][a-z0-9_]*$/;
 const FIELD_NAME_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
 const ENV_VAR_PATTERN = /^[A-Z_][A-Z0-9_]*$/;
@@ -142,9 +146,13 @@ function generateToolCode(spec) {
         : '    return await res.text()\n';
     return `// Generated by the Admin UI's HTTP tool builder (Tools tab) — a
 // parameterized HTTP call, not hand-written logic. Edit freely for
-// anything this template can't express; the Admin UI only ever
-// regenerates a tool it created itself, never overwrites a file it
-// doesn't recognize (see web/http-tool-admin.ts's own HttpToolExistsError).
+// anything this template can't express, but note that hand-editing this
+// file directly (rather than through the Tools tab's own Edit button)
+// leaves the sidecar ${spec.name}.http-tool.json out of sync — the next
+// edit through the UI will overwrite your hand-edits with whatever that
+// sidecar still says. The Admin UI only ever regenerates a tool it
+// created itself, never overwrites a file it doesn't recognize (see
+// web/http-tool-admin.ts's own HttpToolExistsError/HttpToolNotEditableError).
 import type { ToolDefinition } from 'loopengine'
 
 export const ${toCamelCase(spec.name)}: ToolDefinition = {
@@ -163,6 +171,7 @@ ${envReads}    const res = await fetch(\`${urlInner}\`, {
 ${headersObj}${bodyLine}    })
     if (!res.ok) throw new Error(\`${spec.name}: HTTP \${res.status}\`)
 ${responseHandling}  },
+  safe: ${spec.safe === true},
 }
 `;
 }
@@ -191,6 +200,15 @@ function addToolToIndex(toolsIndexPath, toolFileName, exportName) {
     const withEntry = withImport.replace(/export const tools: ToolDefinition\[\] = \[([^\]]*)\]/, `export const tools: ToolDefinition[] = [${newEntries}]`);
     writeFileSync(toolsIndexPath, withEntry);
 }
+// The spec is persisted alongside the generated .ts file, under the same
+// name — this is what lets the Tools tab's Edit button repopulate the
+// form later without reverse-parsing generated code back into a spec,
+// and (its second job) is how readHttpToolSpec/listEditableHttpToolNames
+// tell an admin-created tool apart from a hand-written one: only a tool
+// this module itself created has one.
+function specSidecarPath(toolsDir, name) {
+    return join(toolsDir, `${name}.http-tool.json`);
+}
 /** Generates agents/<agentName>/tools/<spec.name>.ts, registers it in
  * that agent's tools/index.ts, then imports the file it just wrote and
  * returns the real, callable ToolDefinition object — so the route
@@ -210,6 +228,7 @@ export async function createHttpTool(agentName, spec) {
     const code = generateToolCode(spec);
     mkdirSync(toolsDir, { recursive: true });
     writeFileSync(toolPath, code);
+    writeFileSync(specSidecarPath(toolsDir, spec.name), JSON.stringify(spec, null, 2));
     const indexPath = join(toolsDir, 'index.ts');
     if (existsSync(indexPath)) {
         addToolToIndex(indexPath, spec.name, toCamelCase(spec.name));
@@ -221,3 +240,62 @@ export async function createHttpTool(agentName, spec) {
     const mod = (await import(pathToFileURL(toolPath).href));
     return { path: toolPath, tool: mod[exportName] };
 }
+/** Reads back the spec a previous createHttpTool/updateHttpTool call
+ * persisted, for the Tools tab's Edit form to repopulate itself from —
+ * or null if this tool was never created through this module (a
+ * hand-written tools/<name>.ts, or one from before this sidecar existed),
+ * which is exactly the signal the route handler uses to decide whether
+ * to even show an Edit button for it. */
+export function readHttpToolSpec(agentName, toolName) {
+    const sidecarPath = specSidecarPath(join(agentDir(agentName), 'tools'), toolName);
+    if (!existsSync(sidecarPath))
+        return null;
+    return JSON.parse(readFileSync(sidecarPath, 'utf8'));
+}
+/** Every tool name in this agent's tools/ dir with a saved spec — i.e.
+ * every tool the Tools tab can offer an Edit button for. Cheap (one
+ * readdirSync), safe to call on every GET /agents/:name/config. */
+export function listEditableHttpToolNames(agentName) {
+    const toolsDir = join(agentDir(agentName), 'tools');
+    if (!existsSync(toolsDir))
+        return [];
+    return readdirSync(toolsDir)
+        .filter((f) => f.endsWith('.http-tool.json'))
+        .map((f) => f.slice(0, -'.http-tool.json'.length));
+}
+/** Overwrites an existing admin-created tool in place — same generated-
+ * code shape createHttpTool produces, just written to the file that's
+ * already there instead of a new one, and without touching tools/index.ts
+ * (the import/export names are unchanged, since renaming isn't supported
+ * here: spec.name must match toolName). Refuses a tool this module didn't
+ * create (no sidecar spec) rather than silently clobbering hand-written
+ * logic — same "refuse rather than guess" rule addToolToIndex's own doc
+ * comment already applies to index.ts. */
+export async function updateHttpTool(agentName, toolName, spec) {
+    if (spec.name !== toolName) {
+        throw new HttpToolNameError(`A tool's name can't be changed by editing it — "${toolName}" vs "${spec.name}".`);
+    }
+    if (!TOOL_NAME_PATTERN.test(spec.name)) {
+        throw new HttpToolNameError(`Tool name must be lowercase snake_case (e.g. "lookup_order_status") — got "${spec.name}"`);
+    }
+    const toolsDir = join(agentDir(agentName), 'tools');
+    const toolPath = join(toolsDir, `${spec.name}.ts`);
+    if (!existsSync(toolPath)) {
+        throw new HttpToolNotFoundError(`agents/${agentName}/tools/${spec.name}.ts doesn't exist — nothing to edit.`);
+    }
+    const sidecarPath = specSidecarPath(toolsDir, spec.name);
+    if (!existsSync(sidecarPath)) {
+        throw new HttpToolNotEditableError(`agents/${agentName}/tools/${spec.name}.ts wasn't created by this form — edit the file directly instead.`);
+    }
+    const code = generateToolCode(spec);
+    writeFileSync(toolPath, code);
+    writeFileSync(sidecarPath, JSON.stringify(spec, null, 2));
+    const exportName = toCamelCase(spec.name);
+    // Cache-busted: this exact file URL was already imported once before
+    // (at creation, or whenever this agent's tools were last resolved), and
+    // Node's ESM cache is keyed by the literal URL string — a plain
+    // re-import would silently hand back the stale pre-edit module instead
+    // of the code just written above.
+    const mod = (await import(`${pathToFileURL(toolPath).href}?edited=${Date.now()}`));
+    return { path: toolPath, tool: mod[exportName] };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loopengine",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "type": "module",
   "description": "Runtime for tool-using AI agents with a transparent ReAct loop.",
   "license": "MIT",