@theokit/agents 13.0.0-next.8 → 13.0.0

package/dist/{chunk-NZTLBLHB.js → chunk-KTQID5V3.js}

@@ -1,10 +1,16 @@
 import {
   hooksPlugin,
   inheritHooks
-} from "./chunk-RKWCXVYG.js";
+} from "./chunk-MJ6FRILJ.js";
 import {
   compileAgentDefinition
-} from "./chunk-X4IGZHOV.js";
+} from "./chunk-PMMOOXR6.js";
+import {
+  debugLog
+} from "./chunk-M5J3Q6YC.js";
+import {
+  ConfigurationError
+} from "./chunk-U72XTMYB.js";
 import {
   createRunUsageMeter
 } from "./chunk-OXNDJSAJ.js";
@@ -54,209 +60,6 @@ function compileProjectContext(options, base) {
 }
 __name(compileProjectContext, "compileProjectContext");
 
-// src/guardrails/types.ts
-import { TheokitAgentError } from "@theokit/sdk/errors";
-var GuardrailViolationError = class extends TheokitAgentError {
-  static {
-    __name(this, "GuardrailViolationError");
-  }
-  guardName;
-  phase;
-  reason;
-  name = "GuardrailViolationError";
-  constructor(guardName, phase, reason) {
-    super(`Guardrail "${guardName}" blocked ${phase}: ${reason}`, {
-      code: "GUARDRAIL_VIOLATION",
-      // A blocked prompt is a REFUSAL, not a hiccup. Retrying re-submits the very input a
-      // prompt-injection or PII guard just rejected.
-      isRetryable: false
-    }), this.guardName = guardName, this.phase = phase, this.reason = reason;
-  }
-};
-var CostBudgetExceededError = class extends TheokitAgentError {
-  static {
-    __name(this, "CostBudgetExceededError");
-  }
-  usedTokens;
-  maxTokens;
-  name = "CostBudgetExceededError";
-  constructor(usedTokens, maxTokens) {
-    super(`Cost budget exceeded: ${usedTokens} > ${maxTokens} tokens`, {
-      code: "COST_BUDGET_EXCEEDED",
-      // The budget does not refill on retry; retrying spends the next request against the same
-      // exhausted ceiling.
-      isRetryable: false
-    }), this.usedTokens = usedTokens, this.maxTokens = maxTokens;
-  }
-};
-
-// src/guardrails/detectors.ts
-function estimateTokens(text) {
-  return Math.ceil(text.length / 4);
-}
-__name(estimateTokens, "estimateTokens");
-var INJECTION_PHRASES = [
-  "previous instructions",
-  "disregard the above",
-  "you are now dan",
-  "system prompt",
-  "no restrictions",
-  "without restrictions",
-  "no rules",
-  "override your"
-];
-function normalizeForMatch(text) {
-  return text.toLowerCase().replace(/\s+/g, " ");
-}
-__name(normalizeForMatch, "normalizeForMatch");
-function promptInjectionDetector(options = {}) {
-  const phrases = [
-    ...INJECTION_PHRASES,
-    ...(options.extra ?? []).map((p) => p.toLowerCase())
-  ];
-  return {
-    name: "prompt-injection",
-    checkInput(text) {
-      const normalized = normalizeForMatch(text);
-      for (const phrase of phrases) {
-        if (normalized.includes(phrase)) {
-          return {
-            action: "block",
-            reason: `prompt injection phrase matched: "${phrase}"`
-          };
-        }
-      }
-      return {
-        action: "allow"
-      };
-    }
-  };
-}
-__name(promptInjectionDetector, "promptInjectionDetector");
-var CPF = /\b\d{3}\.?\d{3}\.?\d{3}-?\d{2}\b/g;
-var EMAIL = /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g;
-var PHONE = /\+?\d[\d\s()-]{7,13}\d/g;
-function piiDetector(options = {}) {
-  const placeholder = options.placeholder ?? "[REDACTED]";
-  return {
-    name: "pii",
-    checkInput(text) {
-      let redacted = text;
-      redacted = redacted.replace(EMAIL, placeholder);
-      redacted = redacted.replace(CPF, placeholder);
-      redacted = redacted.replace(PHONE, placeholder);
-      if (redacted === text) return {
-        action: "allow"
-      };
-      return {
-        action: "redact",
-        text: redacted,
-        reason: "PII detected and redacted"
-      };
-    }
-  };
-}
-__name(piiDetector, "piiDetector");
-var OBFUSCATION_CHARS = /[\u200B-\u200D\uFEFF\u202A-\u202E\u2066-\u2069]/g;
-function unicodeNormalizer() {
-  return {
-    name: "unicode-normalizer",
-    checkInput(text) {
-      const cleaned = text.normalize("NFKC").replace(OBFUSCATION_CHARS, "");
-      if (cleaned === text) return {
-        action: "allow"
-      };
-      return {
-        action: "redact",
-        text: cleaned,
-        reason: "obfuscation characters normalized"
-      };
-    }
-  };
-}
-__name(unicodeNormalizer, "unicodeNormalizer");
-function costGuard(options) {
-  let used = 0;
-  return {
-    name: "cost-guard",
-    // Returns a Promise explicitly (not `async`) so a budget breach REJECTS uniformly — never a
-    // sync throw — safe for direct callers and for the pipeline's `await g.checkInput()`.
-    checkInput(text) {
-      used += estimateTokens(text);
-      if (used > options.maxTokens) {
-        return Promise.reject(new CostBudgetExceededError(used, options.maxTokens));
-      }
-      return Promise.resolve({
-        action: "allow"
-      });
-    }
-  };
-}
-__name(costGuard, "costGuard");
-function outputModeration(options) {
-  return {
-    name: "output-moderation",
-    async checkOutput(text) {
-      const flagged = await options.moderate(text);
-      return flagged ? {
-        action: "block",
-        reason: "output flagged by moderation predicate"
-      } : {
-        action: "allow"
-      };
-    }
-  };
-}
-__name(outputModeration, "outputModeration");
-
-// src/guardrails/pipeline.ts
-async function runInputGuards(text, guards) {
-  let current = text;
-  for (const g of guards) {
-    if (!g.checkInput) continue;
-    const r = await g.checkInput(current);
-    if (r.action === "block") {
-      throw new GuardrailViolationError(g.name, "input", r.reason ?? "blocked");
-    }
-    if (r.action === "redact" && r.text !== void 0) current = r.text;
-  }
-  return current;
-}
-__name(runInputGuards, "runInputGuards");
-async function runOutputGuards(text, guards) {
-  let current = text;
-  for (const g of guards) {
-    if (!g.checkOutput) continue;
-    const r = await g.checkOutput(current);
-    if (r.action === "block") {
-      throw new GuardrailViolationError(g.name, "output", r.reason ?? "blocked");
-    }
-    if (r.action === "redact" && r.text !== void 0) current = r.text;
-  }
-  return current;
-}
-__name(runOutputGuards, "runOutputGuards");
-
-// src/guardrails/stream.ts
-async function* moderateOutputStream(inner, guards, extractText) {
-  const hasOutputGuard = guards.some((g) => g.checkOutput != null);
-  if (!hasOutputGuard) return yield* inner;
-  const buffered = [];
-  let accumulated = "";
-  let step = await inner.next();
-  while (!step.done) {
-    const event = step.value;
-    const text = extractText(event);
-    if (text !== void 0) accumulated += text;
-    buffered.push(event);
-    step = await inner.next();
-  }
-  await runOutputGuards(accumulated, guards);
-  for (const event of buffered) yield event;
-  return step.value;
-}
-__name(moderateOutputStream, "moderateOutputStream");
-
 // src/bridge/approval-decision.ts
 var APPROVAL_MODES = [
   "suggest",
@@ -345,15 +148,6 @@ function createToolHooksPlugin(hooks) {
 }
 __name(createToolHooksPlugin, "createToolHooksPlugin");
 
-// src/debug-log.ts
-function debugLog(marker, data) {
-  const flag = process.env.THEOKIT_DEBUG;
-  if (flag !== void 0 && flag !== "" && flag !== "0" && flag !== "false") {
-    console.debug(marker, data);
-  }
-}
-__name(debugLog, "debugLog");
-
 // src/bridge/hitl-plugin.ts
 function createHitlPlugin(wiring) {
   return {
@@ -413,74 +207,337 @@ function createHitlPlugin(wiring) {
     }
   };
 }
-__name(createHitlPlugin, "createHitlPlugin");
+__name(createHitlPlugin, "createHitlPlugin");
+
+// src/bridge/approval-posture.ts
+function reasonOf(posturePolicy) {
+  return posturePolicy.kind === "interactive" ? "human approver on this surface" : posturePolicy.reason;
+}
+__name(reasonOf, "reasonOf");
+function applyPosture(extra, m8, posturePolicy, gated) {
+  const ofThePosture = posturePlugins(posturePolicy, gated);
+  if (ofThePosture.length === 0) return;
+  const currentOnes = extra.plugins ?? m8.plugins;
+  if (currentOnes !== void 0 && !Array.isArray(currentOnes)) {
+    throw new Error(`[@theokit/agents] approval posture "${posturePolicy.kind}" needs to install a plugin, but \`plugins\` was supplied in the legacy object form, which cannot carry both. Pass \`plugins\` as an array so the approval gate is not dropped.`);
+  }
+  extra.plugins = [
+    ...currentOnes ?? [],
+    ...ofThePosture
+  ];
+}
+__name(applyPosture, "applyPosture");
+function posturePlugins(posturePolicy, gated) {
+  debugLog("[theokit] approval posture", {
+    kind: posturePolicy.kind,
+    reason: reasonOf(posturePolicy)
+  });
+  if (gated === void 0 || gated.size === 0) return [];
+  switch (posturePolicy.kind) {
+    case "interactive":
+      return [
+        createHitlPlugin({
+          gated,
+          emit: posturePolicy.emit,
+          awaitApproval: posturePolicy.awaitApproval
+        })
+      ];
+    case "auto-approve":
+      if (!shouldAutoApprove("full-auto", "*", posturePolicy.confinedBy)) {
+        throw new Error(`[@theokit/agents] approval posture "auto-approve" claims confinement ("${posturePolicy.reason}"), but the sandbox reports it is NOT enforced: ${posturePolicy.confinedBy.detail} (mode: ${posturePolicy.confinedBy.mode}). Auto-approving gated tools without enforced confinement runs arbitrary commands with no human and no sandbox. Use "interactive" (a human decides) or "auto-reject" (fail-closed) until the sandbox reports enforced.`);
+      }
+      return [
+        createToolHooksPlugin({
+          beforeToolCall: /* @__PURE__ */ __name((ctx) => {
+            if (gated.has(ctx.name)) {
+              debugLog("[theokit] gated tool auto-approved", {
+                tool: ctx.name,
+                reason: posturePolicy.reason
+              });
+            }
+            return void 0;
+          }, "beforeToolCall")
+        })
+      ];
+    case "auto-reject":
+      return [
+        createToolHooksPlugin({
+          // Only GATED tools are refused: the posture describes the gate, not a universal block.
+          // Refusing everything would break every agent with a free tool next to a gated one.
+          beforeToolCall: /* @__PURE__ */ __name((ctx) => gated.has(ctx.name) ? {
+            block: true,
+            message: `Tool '${ctx.name}' requires human approval, and this surface has no approver (approval posture: auto-reject \u2014 ${posturePolicy.reason}). Refused (fail-closed).`
+          } : void 0, "beforeToolCall")
+        })
+      ];
+    case "owned-by-surface":
+      return [];
+  }
+}
+__name(posturePlugins, "posturePlugins");
+
+// src/guardrails/types.ts
+import { TheokitAgentError } from "@theokit/sdk/errors";
+var GuardrailError = class extends TheokitAgentError {
+  static {
+    __name(this, "GuardrailError");
+  }
+};
+var MalformedGuardrailResultError = class extends GuardrailError {
+  static {
+    __name(this, "MalformedGuardrailResultError");
+  }
+  guardName;
+  phase;
+  name = "MalformedGuardrailResultError";
+  constructor(guardName, phase) {
+    super(`Guardrail "${guardName}" returned action 'redact' for ${phase} with no replacement text. Nothing was redacted. Supply \`text\` (\`''\` erases), or return 'allow' or 'block'.`, {
+      code: "GUARDRAIL_RESULT_MALFORMED",
+      // A guard written wrong is not written right on the next attempt.
+      isRetryable: false
+    }), this.guardName = guardName, this.phase = phase;
+  }
+};
+var GuardrailViolationError = class extends GuardrailError {
+  static {
+    __name(this, "GuardrailViolationError");
+  }
+  guardName;
+  phase;
+  reason;
+  name = "GuardrailViolationError";
+  constructor(guardName, phase, reason) {
+    super(`Guardrail "${guardName}" blocked ${phase}: ${reason}`, {
+      code: "GUARDRAIL_VIOLATION",
+      // A blocked prompt is a REFUSAL, not a hiccup. Retrying re-submits the very input a
+      // prompt-injection or PII guard just rejected.
+      isRetryable: false
+    }), this.guardName = guardName, this.phase = phase, this.reason = reason;
+  }
+};
+var UnreadableTextPayloadError = class extends GuardrailError {
+  static {
+    __name(this, "UnreadableTextPayloadError");
+  }
+  eventType;
+  received;
+  name = "UnreadableTextPayloadError";
+  constructor(eventType, received) {
+    super(`A "${eventType}" event carried a non-string content (${typeof received}), which no guard can read. It was previously delivered unexamined. Fix the producer, or stop declaring the event as text-carrying.`, {
+      code: "GUARDRAIL_UNREADABLE_PAYLOAD",
+      isRetryable: false
+    }), this.eventType = eventType, this.received = received;
+  }
+};
+var CostBudgetExceededError = class extends GuardrailError {
+  static {
+    __name(this, "CostBudgetExceededError");
+  }
+  usedTokens;
+  maxTokens;
+  name = "CostBudgetExceededError";
+  constructor(usedTokens, maxTokens) {
+    super(`Cost budget exceeded: ${usedTokens} > ${maxTokens} tokens`, {
+      code: "COST_BUDGET_EXCEEDED",
+      // The budget does not refill on retry; retrying spends the next request against the same
+      // exhausted ceiling.
+      isRetryable: false
+    }), this.usedTokens = usedTokens, this.maxTokens = maxTokens;
+  }
+};
+
+// src/guardrails/detectors.ts
+function estimateTokens(text) {
+  return Math.ceil(text.length / 4);
+}
+__name(estimateTokens, "estimateTokens");
+var INJECTION_PHRASES = [
+  "previous instructions",
+  "disregard the above",
+  "you are now dan",
+  "system prompt",
+  "no restrictions",
+  "without restrictions",
+  "no rules",
+  "override your"
+];
+function normalizeForMatch(text) {
+  return text.toLowerCase().replace(/\s+/g, " ");
+}
+__name(normalizeForMatch, "normalizeForMatch");
+function promptInjectionDetector(options = {}) {
+  const phrases = [
+    ...INJECTION_PHRASES,
+    ...(options.extra ?? []).map((p) => p.toLowerCase())
+  ];
+  return {
+    name: "prompt-injection",
+    checkInput(text) {
+      const normalized = normalizeForMatch(text);
+      for (const phrase of phrases) {
+        if (normalized.includes(phrase)) {
+          return {
+            action: "block",
+            reason: `prompt injection phrase matched: "${phrase}"`
+          };
+        }
+      }
+      return {
+        action: "allow"
+      };
+    }
+  };
+}
+__name(promptInjectionDetector, "promptInjectionDetector");
+var CPF = /\b\d{3}\.?\d{3}\.?\d{3}-?\d{2}\b/g;
+var EMAIL = /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g;
+var PHONE = /\+?\d[\d\s()-]{7,13}\d/g;
+function piiDetector(options = {}) {
+  const placeholder = options.placeholder ?? "[REDACTED]";
+  return {
+    name: "pii",
+    checkInput(text) {
+      let redacted = text;
+      redacted = redacted.replace(EMAIL, placeholder);
+      redacted = redacted.replace(CPF, placeholder);
+      redacted = redacted.replace(PHONE, placeholder);
+      if (redacted === text) return {
+        action: "allow"
+      };
+      return {
+        action: "redact",
+        text: redacted,
+        reason: "PII detected and redacted"
+      };
+    }
+  };
+}
+__name(piiDetector, "piiDetector");
+var OBFUSCATION_CHARS = /[\u200B-\u200D\uFEFF\u202A-\u202E\u2066-\u2069]/g;
+function unicodeNormalizer() {
+  return {
+    name: "unicode-normalizer",
+    checkInput(text) {
+      const cleaned = text.normalize("NFKC").replace(OBFUSCATION_CHARS, "");
+      if (cleaned === text) return {
+        action: "allow"
+      };
+      return {
+        action: "redact",
+        text: cleaned,
+        reason: "obfuscation characters normalized"
+      };
+    }
+  };
+}
+__name(unicodeNormalizer, "unicodeNormalizer");
+function costGuard(options) {
+  let used = 0;
+  return {
+    name: "cost-guard",
+    // Returns a Promise explicitly (not `async`) so a budget breach REJECTS uniformly — never a
+    // sync throw — safe for direct callers and for the pipeline's `await g.checkInput()`.
+    checkInput(text) {
+      used += estimateTokens(text);
+      if (used > options.maxTokens) {
+        return Promise.reject(new CostBudgetExceededError(used, options.maxTokens));
+      }
+      return Promise.resolve({
+        action: "allow"
+      });
+    }
+  };
+}
+__name(costGuard, "costGuard");
+function outputModeration(options) {
+  return {
+    name: "output-moderation",
+    async checkOutput(text) {
+      const flagged = await options.moderate(text);
+      return flagged ? {
+        action: "block",
+        reason: "output flagged by moderation predicate"
+      } : {
+        action: "allow"
+      };
+    }
+  };
+}
+__name(outputModeration, "outputModeration");
 
-// src/bridge/approval-posture.ts
-function reasonOf(posturePolicy) {
-  return posturePolicy.kind === "interactive" ? "human approver on this surface" : posturePolicy.reason;
-}
-__name(reasonOf, "reasonOf");
-function applyPosture(extra, m8, posturePolicy, gated) {
-  const ofThePosture = posturePlugins(posturePolicy, gated);
-  if (ofThePosture.length === 0) return;
-  const currentOnes = extra.plugins ?? m8.plugins;
-  if (currentOnes !== void 0 && !Array.isArray(currentOnes)) {
-    throw new Error(`[@theokit/agents] approval posture "${posturePolicy.kind}" needs to install a plugin, but \`plugins\` was supplied in the legacy object form, which cannot carry both. Pass \`plugins\` as an array so the approval gate is not dropped.`);
+// src/guardrails/pipeline.ts
+async function runGuards(text, guards, phase) {
+  const check = phase === "input" ? "checkInput" : "checkOutput";
+  let current = text;
+  for (const g of guards) {
+    const fn = g[check];
+    if (!fn) continue;
+    const r = await fn.call(g, current);
+    if (r.action === "block") {
+      throw new GuardrailViolationError(g.name, phase, r.reason ?? "blocked");
+    }
+    if (r.action === "redact") {
+      if (r.text === void 0) throw new MalformedGuardrailResultError(g.name, phase);
+      current = r.text;
+    }
   }
-  extra.plugins = [
-    ...currentOnes ?? [],
-    ...ofThePosture
-  ];
+  return current;
 }
-__name(applyPosture, "applyPosture");
-function posturePlugins(posturePolicy, gated) {
-  debugLog("[theokit] approval posture", {
-    kind: posturePolicy.kind,
-    reason: reasonOf(posturePolicy)
-  });
-  if (gated === void 0 || gated.size === 0) return [];
-  switch (posturePolicy.kind) {
-    case "interactive":
-      return [
-        createHitlPlugin({
-          gated,
-          emit: posturePolicy.emit,
-          awaitApproval: posturePolicy.awaitApproval
-        })
-      ];
-    case "auto-approve":
-      if (!shouldAutoApprove("full-auto", "*", posturePolicy.confinedBy)) {
-        throw new Error(`[@theokit/agents] approval posture "auto-approve" claims confinement ("${posturePolicy.reason}"), but the sandbox reports it is NOT enforced: ${posturePolicy.confinedBy.detail} (mode: ${posturePolicy.confinedBy.mode}). Auto-approving gated tools without enforced confinement runs arbitrary commands with no human and no sandbox. Use "interactive" (a human decides) or "auto-reject" (fail-closed) until the sandbox reports enforced.`);
-      }
-      return [
-        createToolHooksPlugin({
-          beforeToolCall: /* @__PURE__ */ __name((ctx) => {
-            if (gated.has(ctx.name)) {
-              debugLog("[theokit] gated tool auto-approved", {
-                tool: ctx.name,
-                reason: posturePolicy.reason
-              });
-            }
-            return void 0;
-          }, "beforeToolCall")
-        })
-      ];
-    case "auto-reject":
-      return [
-        createToolHooksPlugin({
-          // Only GATED tools are refused: the posture describes the gate, not a universal block.
-          // Refusing everything would break every agent with a free tool next to a gated one.
-          beforeToolCall: /* @__PURE__ */ __name((ctx) => gated.has(ctx.name) ? {
-            block: true,
-            message: `Tool '${ctx.name}' requires human approval, and this surface has no approver (approval posture: auto-reject \u2014 ${posturePolicy.reason}). Refused (fail-closed).`
-          } : void 0, "beforeToolCall")
-        })
-      ];
-    case "owned-by-surface":
-      return [];
+__name(runGuards, "runGuards");
+async function runInputGuards(text, guards) {
+  return runGuards(text, guards, "input");
+}
+__name(runInputGuards, "runInputGuards");
+async function runOutputGuards(text, guards) {
+  return runGuards(text, guards, "output");
+}
+__name(runOutputGuards, "runOutputGuards");
+
+// src/guardrails/stream.ts
+async function* moderateOutputStream(inner, guards, extractText, rebuildText, rebuildResult) {
+  const hasOutputGuard = guards.some((g) => g.checkOutput != null);
+  if (!hasOutputGuard) return yield* inner;
+  const buffered = [];
+  const textAt = [];
+  let accumulated = "";
+  let step = await inner.next();
+  while (!step.done) {
+    const event = step.value;
+    const text = extractText(event);
+    if (text !== void 0) accumulated += text;
+    buffered.push(event);
+    textAt.push(text !== void 0);
+    step = await inner.next();
+  }
+  if (!textAt.includes(true)) {
+    for (const event of buffered) yield event;
+    return step.value;
+  }
+  const moderated = await runOutputGuards(accumulated, guards);
+  if (moderated === accumulated) {
+    for (const event of buffered) yield event;
+    return step.value;
   }
+  const last = textAt.lastIndexOf(true);
+  for (const [index, event] of buffered.entries()) {
+    if (!textAt[index]) {
+      yield event;
+      continue;
+    }
+    if (index === last) yield rebuildText(moderated, event);
+  }
+  return rebuildResult(moderated, step.value);
 }
-__name(posturePlugins, "posturePlugins");
+__name(moderateOutputStream, "moderateOutputStream");
+function textPayloadExtractor(kind, read) {
+  return (event) => {
+    if (event.type !== kind) return void 0;
+    const content = read(event);
+    if (typeof content !== "string") throw new UnreadableTextPayloadError(kind, content);
+    return content;
+  };
+}
+__name(textPayloadExtractor, "textPayloadExtractor");
 
 // src/bridge/model-selection.ts
 var PARAM_THINKING = "thinking";
@@ -519,11 +576,46 @@ __name(reasoningEffortOf, "reasoningEffortOf");
 
 // src/bridge/sdk-adapter-create-options.ts
 import { createRequire } from "module";
+import { PermissionEngine, PermissionPlugin } from "@theokit/sdk";
 import { TheokitAgentError as TheokitAgentError2 } from "@theokit/sdk/errors";
+
+// src/bridge/code-plugins.ts
+var BUNDLE_KEYS = [
+  "path",
+  "type",
+  "source",
+  "marketplace"
+];
+function assertCodePlugins(list) {
+  for (const entry of list) {
+    if (isCodePlugin(entry)) continue;
+    const looksLikeBundle = typeof entry === "object" && entry !== null && BUNDLE_KEYS.some((k) => k in entry);
+    throw new ConfigurationError(looksLikeBundle ? "plugins() takes CODE plugins \u2014 { name, register } objects registered with the runtime's lifecycle seam. The entry given describes a filesystem bundle, which is not declared here: put the bundle in a `plugins/` directory under `.theokit/` or `.claude/`, where its `skills/` and `agents/` are discovered. Note that the manifest (`.claude-plugin/plugin.json`), marketplaces, hooks, MCP servers, output styles and LSP servers are NOT read from a bundle by this runtime." : `plugins() takes { name, register } objects; received ${describe(entry)}.`, {
+      code: "plugins_expects_code_objects"
+    });
+  }
+}
+__name(assertCodePlugins, "assertCodePlugins");
+function describe(entry) {
+  return entry === null ? "null" : typeof entry;
+}
+__name(describe, "describe");
+function isCodePlugin(entry) {
+  if (typeof entry !== "object" || entry === null) return false;
+  const candidate = entry;
+  return typeof candidate.name === "string" && typeof candidate.register === "function";
+}
+__name(isCodePlugin, "isCodePlugin");
+
+// src/bridge/sdk-adapter-create-options.ts
 var HOOK_GATE_SINCE = {
   major: 5,
   minor: 4
 };
+var COMPAT_IMPORT_SINCE = {
+  major: 5,
+  minor: 4
+};
 var HookGateUnsupportedError = class extends TheokitAgentError2 {
   static {
     __name(this, "HookGateUnsupportedError");
@@ -536,6 +628,41 @@ var HookGateUnsupportedError = class extends TheokitAgentError2 {
     });
   }
 };
+var CompatImportUnsupportedError = class extends TheokitAgentError2 {
+  static {
+    __name(this, "CompatImportUnsupportedError");
+  }
+  name = "CompatImportUnsupportedError";
+  constructor(version) {
+    super(`\`claudeCode.import\` narrows WHICH surfaces of a foreign configuration root to read, but the installed @theokit/sdk (${version ?? "version unreadable"}) cannot honour it: the narrowed shape landed in ${String(COMPAT_IMPORT_SINCE.major)}.${String(COMPAT_IMPORT_SINCE.minor)}.0. An older runtime drops the unrecognised shape in silence, so the root would not be read AT ALL \u2014 less than you asked for, not more. Upgrade @theokit/sdk, or omit \`import\` to read every surface of the root (usetheokit/theokit#686).`, {
+      code: "compat_import_unsupported",
+      isRetryable: false
+    });
+  }
+};
+function compatSourcesForSdk(sources) {
+  const out = [];
+  for (const source of sources) {
+    if (typeof source === "string") {
+      out.push(source);
+      continue;
+    }
+    const forSdk = source.import.filter((surface) => surface !== "commands");
+    if (forSdk.length > 0) out.push({
+      kind: source.kind,
+      import: forSdk
+    });
+  }
+  return out;
+}
+__name(compatSourcesForSdk, "compatSourcesForSdk");
+function assertSdkCanReadNarrowedImport(version) {
+  const [major, minor] = (version ?? "").split(".").map((n) => Number.parseInt(n, 10));
+  const known = Number.isFinite(major) && Number.isFinite(minor);
+  const supported = known && (major > COMPAT_IMPORT_SINCE.major || major === COMPAT_IMPORT_SINCE.major && minor >= COMPAT_IMPORT_SINCE.minor);
+  if (!supported) throw new CompatImportUnsupportedError(version);
+}
+__name(assertSdkCanReadNarrowedImport, "assertSdkCanReadNarrowedImport");
 function assertSdkCanGateHooks(version) {
   const [major, minor] = (version ?? "").split(".").map((n) => Number.parseInt(n, 10));
   const known = Number.isFinite(major) && Number.isFinite(minor);
@@ -566,6 +693,29 @@ function warnIfSdkCannotReadCompatSources() {
   console.warn(`[theokit/agents] \`compatSources\` was declared, but @theokit/sdk@${version} does not know that option and will ignore it \u2014 the foreign configuration root will NOT be read. It landed in 5.0.0. Until this package's floor can name a stable 5.x, override the SDK in your workspace (usetheokit/theokit#634).`);
 }
 __name(warnIfSdkCannotReadCompatSources, "warnIfSdkCannotReadCompatSources");
+function applyPlugins(compiled, options, applied) {
+  if (compiled.plugins) {
+    assertCodePlugins(compiled.plugins);
+    options.plugins = compiled.plugins;
+    applied.push("plugins");
+  }
+  if (compiled.canUseTool !== void 0) {
+    options.plugins = [
+      ...options.plugins ?? [],
+      // An engine with NO rules and the SDK's fail-closed default: every call resolves to `ask`,
+      // so every call reaches the gate. That IS "one callback sees every tool call the earlier
+      // steps did not resolve" — there are no earlier steps to resolve one.
+      //
+      // A consumer who also wants rules composes them through the SDK directly; declaring both here
+      // would mean inventing a precedence between a rule set and a gate that nobody stated.
+      PermissionPlugin.create(new PermissionEngine([]), {
+        canUseTool: compiled.canUseTool
+      })
+    ];
+    applied.push("canUseTool");
+  }
+}
+__name(applyPlugins, "applyPlugins");
 function applyLocalSources(compiled, options, applied) {
   if (compiled.settingSources !== void 0 && compiled.settingSources.length > 0) {
     options.local = {
@@ -576,15 +726,26 @@ function applyLocalSources(compiled, options, applied) {
     };
     applied.push("settingSources");
   }
-  if (compiled.compatSources !== void 0 && compiled.compatSources.length > 0) {
+  if (compiled.sessionStore !== void 0) {
     options.local = {
       ...options.local,
-      compatSources: [
-        ...compiled.compatSources
-      ]
+      sessionStore: compiled.sessionStore
     };
-    applied.push("compatSources");
-    warnIfSdkCannotReadCompatSources();
+    applied.push("sessionStore");
+  }
+  if (compiled.compatSources !== void 0 && compiled.compatSources.length > 0) {
+    const forSdk = compatSourcesForSdk(compiled.compatSources);
+    if (forSdk.some((c) => typeof c === "object" && "import" in c)) {
+      assertSdkCanReadNarrowedImport(installedSdkVersion());
+    }
+    if (forSdk.length > 0) {
+      options.local = {
+        ...options.local,
+        compatSources: forSdk
+      };
+      applied.push("compatSources");
+      warnIfSdkCannotReadCompatSources();
+    }
   }
 }
 __name(applyLocalSources, "applyLocalSources");
@@ -606,9 +767,10 @@ function assembleM8CreateOptions(compiled, deps = {}) {
     options.skills = compiled.skills;
     applied.push("skills");
   }
-  if (compiled.plugins) {
-    options.plugins = compiled.plugins;
-    applied.push("plugins");
+  applyPlugins(compiled, options, applied);
+  if (compiled.agents !== void 0 && Object.keys(compiled.agents).length > 0) {
+    options.agents = compiled.agents;
+    applied.push("agents");
   }
   applyLocalSources(compiled, options, applied);
   applyHookApproval(compiled, options, applied, deps.sdkVersion);
@@ -641,6 +803,10 @@ function assembleM8CreateOptions(compiled, deps = {}) {
     }
     applied.push("memory");
   }
+  if (compiled.telemetry !== void 0) {
+    options.telemetry = compiled.telemetry;
+    applied.push("telemetry");
+  }
   return {
     options,
     applied
@@ -1056,6 +1222,54 @@ function resolveProjection(def, overrides) {
 }
 __name(resolveProjection, "resolveProjection");
 
+// src/bridge/handle-wrappers.ts
+function withStepCeiling(handle, maxIterations) {
+  if (maxIterations === void 0) return handle;
+  return {
+    get agentId() {
+      return handle.agentId;
+    },
+    dispose: /* @__PURE__ */ __name(() => handle.dispose(), "dispose"),
+    // Forwarded — see {@link SdkAgentHandle.generate} for why, and why it is not guarded.
+    ...handle.generate === void 0 ? {} : {
+      generate: handle.generate.bind(handle)
+    },
+    send: /* @__PURE__ */ __name((msg, sendOpts) => handle.send(msg, {
+      maxIterations,
+      ...sendOpts
+    }), "send")
+  };
+}
+__name(withStepCeiling, "withStepCeiling");
+function withGuardrails(handle, guardrails) {
+  if (guardrails === void 0 || guardrails.length === 0) return handle;
+  return {
+    get agentId() {
+      return handle.agentId;
+    },
+    dispose: /* @__PURE__ */ __name(() => handle.dispose(), "dispose"),
+    // Forwarded — see {@link SdkAgentHandle.generate} for why, and why it is not guarded.
+    ...handle.generate === void 0 ? {} : {
+      generate: handle.generate.bind(handle)
+    },
+    send: /* @__PURE__ */ __name(async (msg, sendOpts) => {
+      const guarded = await runInputGuards(msg, guardrails);
+      const turn = await handle.send(guarded, sendOpts);
+      return {
+        wait: /* @__PURE__ */ __name(async () => {
+          const out = await turn.wait();
+          if (out.result === void 0) return out;
+          return {
+            ...out,
+            result: await runOutputGuards(out.result, guardrails)
+          };
+        }, "wait")
+      };
+    }, "send")
+  };
+}
+__name(withGuardrails, "withGuardrails");
+
 // src/bridge/sdk-error.ts
 function sdkErrorEvent(err) {
   const sdkErr = err;
@@ -1635,44 +1849,6 @@ function toAgentFactory(def, opts) {
   };
 }
 __name(toAgentFactory, "toAgentFactory");
-function withStepCeiling(handle, maxIterations) {
-  if (maxIterations === void 0) return handle;
-  return {
-    get agentId() {
-      return handle.agentId;
-    },
-    dispose: /* @__PURE__ */ __name(() => handle.dispose(), "dispose"),
-    send: /* @__PURE__ */ __name((msg, sendOpts) => handle.send(msg, {
-      maxIterations,
-      ...sendOpts
-    }), "send")
-  };
-}
-__name(withStepCeiling, "withStepCeiling");
-function withGuardrails(handle, guardrails) {
-  if (guardrails === void 0 || guardrails.length === 0) return handle;
-  return {
-    get agentId() {
-      return handle.agentId;
-    },
-    dispose: /* @__PURE__ */ __name(() => handle.dispose(), "dispose"),
-    send: /* @__PURE__ */ __name(async (msg, sendOpts) => {
-      const guarded = await runInputGuards(msg, guardrails);
-      const turn = await handle.send(guarded, sendOpts);
-      return {
-        wait: /* @__PURE__ */ __name(async () => {
-          const out = await turn.wait();
-          if (out.result === void 0) return out;
-          return {
-            ...out,
-            result: await runOutputGuards(out.result, guardrails)
-          };
-        }, "wait")
-      };
-    }, "send")
-  };
-}
-__name(withGuardrails, "withGuardrails");
 
 // src/loop/compaction-strategy.ts
 import { compactTranscript } from "@theokit/sdk/compaction";
@@ -1862,7 +2038,9 @@ async function* consumeRoundOrThrow(inputs, agentName) {
   try {
     return yield* consumeOneRound(inputs.factory, inputs.prompt, inputs.sessionId, inputs.signal, inputs.retry);
   } catch (err) {
-    if (err instanceof DelegationBudgetExceededError || err instanceof DelegationError) throw err;
+    if (err instanceof DelegationBudgetExceededError || err instanceof DelegationError || err instanceof GuardrailError) {
+      throw err;
+    }
     throw new DelegationError(agentName, err);
   }
 }
@@ -2125,7 +2303,33 @@ var AgentRunner = class {
       const runUnguarded = /* @__PURE__ */ __name((m) => this.streamUnguarded(m, opts), "runUnguarded");
       return (/* @__PURE__ */ __name(async function* guarded() {
         const safe = await runInputGuards(message, guardrails);
-        return yield* moderateOutputStream(runUnguarded(safe), guardrails, (e) => e.type === "text_delta" && typeof e.content === "string" ? e.content : void 0);
+        return yield* moderateOutputStream(
+          moderateOutputStream(
+            runUnguarded(safe),
+            guardrails,
+            // B-021 — the shared extractor, so "this kind, content unreadable" throws instead of
+            // sharing a return value with "not this kind". The hand-written form here returned
+            // `undefined` for a non-string, which reads as "carries no text": the payload was never
+            // shown to a guard and was yielded verbatim.
+            textPayloadExtractor("text_delta", (e) => e.content),
+            (content) => ({
+              type: "text_delta",
+              content
+            }),
+            (content, result) => ({
+              ...result,
+              response: content
+            })
+          ),
+          guardrails,
+          textPayloadExtractor("thinking", (e) => e.content),
+          (content) => ({
+            type: "thinking",
+            content
+          }),
+          // The reasoning pass does NOT touch the aggregate — the visible pass already did.
+          (_content, result) => result
+        );
       }, "guarded"))();
     }
     return this.streamUnguarded(message, opts);
@@ -2349,11 +2553,13 @@ function mergeTools(parentTools, subTools) {
 __name(mergeTools, "mergeTools");
 async function delegate(spec, message, opts = {}) {
   const apiKey = requireApiKey(opts, spec.name);
-  const effectiveMessage = opts.onDelegationStart ? await opts.onDelegationStart({
+  const rewritten = opts.onDelegationStart ? await opts.onDelegationStart({
     subAgent: spec.name,
     input: message
   }) : message;
   const { compiled } = spec;
+  const guardrails = compiled.guardrails ?? [];
+  const effectiveMessage = await runInputGuards(rewritten, guardrails);
   const allTools = mergeTools(opts.parentTools ?? [], compiled.tools);
   const budget = Math.min(opts.budget ?? Infinity, opts.parentBudgetRemaining ?? Infinity);
   const compiledForMember = withInheritedHooks(compiled, opts.parentHooks);
@@ -2377,15 +2583,21 @@ async function delegate(spec, message, opts = {}) {
     signal: opts.signal,
     retry: opts.retry
   });
-  if (opts.onDelegationComplete) {
-    return await opts.onDelegationComplete({
-      subAgent: spec.name,
-      result
-    });
-  }
-  return result;
+  const transformed = opts.onDelegationComplete ? await opts.onDelegationComplete({
+    subAgent: spec.name,
+    result
+  }) : result;
+  return await moderateDelegationResult(transformed, guardrails);
 }
 __name(delegate, "delegate");
+async function moderateDelegationResult(result, guardrails) {
+  if (guardrails.length === 0) return result;
+  return {
+    ...result,
+    response: await runOutputGuards(result.response, guardrails)
+  };
+}
+__name(moderateDelegationResult, "moderateDelegationResult");
 
 // src/bridge/delegation-lifecycle.ts
 import { TheokitAgentError as TheokitAgentError5 } from "@theokit/sdk/errors";
@@ -2436,7 +2648,8 @@ __name(withEphemeralAgent, "withEphemeralAgent");
 
 // src/bridge/delegation-scoring.ts
 function isPort(target) {
-  return "run" in target;
+  if ("compiled" in target) return false;
+  return typeof target.run === "function";
 }
 __name(isPort, "isPort");
 async function runOnce(target, message, delegateFn, opts) {
@@ -2502,7 +2715,16 @@ __name(delegateWithScoring, "delegateWithScoring");
 export {
   projectContextMetadataOnlyKnobs,
   compileProjectContext,
+  APPROVAL_MODES,
+  WRITE_SCOPED_TOOLS,
+  shouldAutoApprove,
+  createHitlPlugin,
+  createToolHooksPlugin,
+  applyPosture,
+  GuardrailError,
+  MalformedGuardrailResultError,
   GuardrailViolationError,
+  UnreadableTextPayloadError,
   CostBudgetExceededError,
   estimateTokens,
   promptInjectionDetector,
@@ -2513,15 +2735,11 @@ export {
   runInputGuards,
   runOutputGuards,
   moderateOutputStream,
-  APPROVAL_MODES,
-  WRITE_SCOPED_TOOLS,
-  shouldAutoApprove,
-  createHitlPlugin,
-  createToolHooksPlugin,
-  applyPosture,
+  textPayloadExtractor,
   buildModelSelection,
   reasoningEffortOf,
   HookGateUnsupportedError,
+  CompatImportUnsupportedError,
   translateSdkEvent,
   createThinkTagExtractor,
   extractThinkTagStream,
@@ -2553,4 +2771,4 @@ export {
   delegateBackground,
   delegateWithScoring
 };
-//# sourceMappingURL=chunk-NZTLBLHB.js.map
+//# sourceMappingURL=chunk-KTQID5V3.js.map