@theokit/sdk 3.2.0 → 3.2.2

package/dist/eval.cjs

@@ -4743,7 +4743,14 @@ var init_env_policy = __esm({
       /[_-]PWD/i,
       /CREDENTIAL/i,
       /PRIVATE/i,
-      /_AUTH/i
+      /_AUTH/i,
+      // #54-a — value-embedded-secret conventions (no generic `*_URL` — see keep-list test).
+      /DSN/i,
+      /WEBHOOK/i,
+      /COOKIE/i,
+      /CONNECTION[_-]?STRING/i,
+      // Known DB / message-broker connection-string vars (carry `user:pass@`).
+      /(?:^|[_-])(?:DATABASE|DB|REDIS|MONGO(?:DB)?|POSTGRES(?:QL)?|MYSQL|MARIADB|AMQP|RABBITMQ|CLICKHOUSE|ELASTIC(?:SEARCH)?|CASSANDRA|COUCHDB|MEMCACHED|NATS|KAFKA)[_-]?(?:URL|URI|DSN|CONNECTION)/i
     ];
     CORE_VARS = [
       "PATH",
@@ -7740,15 +7747,19 @@ async function collectChildToolResults(run) {
 ${lines.join("\n")}
 </subagent-tool-results>`;
 }
-async function runChildAgent(spec, input, signal, maxSteps, inherited) {
-  const { Agent: Agent2 } = await Promise.resolve().then(() => (init_agent(), agent_exports));
+function buildChildCreateOptions(spec, inherited) {
   const model = spec.model ? { id: spec.model } : inherited?.model;
-  const agent = await Agent2.create({
+  return {
     ...inherited?.apiKey !== void 0 ? { apiKey: inherited.apiKey } : {},
     ...model !== void 0 ? { model } : {},
+    ...inherited?.plugins !== void 0 ? { plugins: inherited.plugins } : {},
     systemPrompt: spec.instructions,
     tools: spec.tools ?? []
-  });
+  };
+}
+async function runChildAgent(spec, input, signal, maxSteps, inherited) {
+  const { Agent: Agent2 } = await Promise.resolve().then(() => (init_agent(), agent_exports));
+  const agent = await Agent2.create(buildChildCreateOptions(spec, inherited));
   try {
     const sendOptions = {
       ...signal !== void 0 ? { signal } : {},
@@ -9651,7 +9662,10 @@ async function runAgentLoop(inputs) {
       }
       budget.consume();
       inputs.budgetTracker?.nextIteration?.();
-      if (inputs.signal?.aborted === true) break;
+      if (inputs.signal?.aborted === true) {
+        ctx.finalStatus = "cancelled";
+        break;
+      }
     }
     if (lastTurnDecision === "continue" && budget.shouldContinue() === false) {
       ctx.stoppedAtIterationLimit = true;
@@ -9836,15 +9850,15 @@ async function guardAndTransformToolResults(inputs, raw, ctx) {
 }
 async function continueOrTerminate(inputs, ctx, llmOutput) {
   if (llmOutput.errored) return "error";
-  if (llmOutput.text.length > 0) {
-    await emitAssistantTextStep(inputs, ctx, llmOutput.text);
+  const tCtx = { agentId: inputs.agentId, runId: inputs.runId };
+  const text = llmOutput.text.length > 0 ? await transformLlmOutputText(inputs, llmOutput.text, tCtx) : llmOutput.text;
+  if (text.length > 0) {
+    await emitAssistantTextStep(inputs, ctx, text);
   }
   if (llmOutput.stopReason !== "tool_use" || llmOutput.toolCalls.length === 0) {
     return finishOrReflect(inputs, ctx, llmOutput);
   }
-  const tCtx = { agentId: inputs.agentId, runId: inputs.runId };
-  const outText = await transformLlmOutputText(inputs, llmOutput.text, tCtx);
-  ctx.messages.push(buildAssistantTurn(outText, llmOutput.toolCalls));
+  ctx.messages.push(buildAssistantTurn(text, llmOutput.toolCalls));
   const rawResults = await dispatchTools(
     // SE12 — forward a read-only text projection of the transcript-so-far to tool
     // handlers via `ctx.messages` (consumed by defineSubAgent's messageFilter).
@@ -13168,7 +13182,12 @@ var init_client = __esm({
             code: "mcp_http_error"
           });
         }
-        return await response.json();
+        try {
+          return await response.json();
+        } catch (cause) {
+          if (isAbortLike(cause)) throw mcpTimeoutError(this.name, timeoutMs);
+          throw cause;
+        }
       }
     };
   }
@@ -13408,9 +13427,11 @@ function declarativeSubagentTools(agentOptions, parentTools) {
   return subAgentToolsFromDefinitions(agents2, parentTools);
 }
 function bindParentCredentials(tools, agentOptions) {
+  const parentPlugins = Array.isArray(agentOptions.plugins) ? agentOptions.plugins : void 0;
   const credentials = {
     ...agentOptions.apiKey !== void 0 ? { apiKey: agentOptions.apiKey } : {},
-    ...typeof agentOptions.model === "object" ? { model: agentOptions.model } : {}
+    ...typeof agentOptions.model === "object" ? { model: agentOptions.model } : {},
+    ...parentPlugins !== void 0 ? { plugins: parentPlugins } : {}
   };
   for (const tool of tools) inheritSubAgentCredentials(tool, credentials);
 }
@@ -15935,10 +15956,11 @@ var init_local_agent_memory = __esm({
       }
       buildTelemetryRecallArgs(telemetry) {
         const userId = typeof this.options.memoryContext?.userId === "string" ? this.options.memoryContext.userId : void 0;
+        const tenantId = typeof this.options.memoryContext?.tenantId === "string" ? this.options.memoryContext.tenantId : void 0;
         return {
           ...telemetry !== void 0 ? { telemetry } : {},
           ...userId !== void 0 ? { userId } : {},
-          namespace: "default",
+          namespace: tenantId ?? "default",
           scope: "session"
         };
       }
@@ -19824,14 +19846,6 @@ async function llmJudgeScore(options) {
 init_env_policy();
 
 // src/sandbox/types.ts
-var SandboxSecurityError = class extends Error {
-  code = "sandbox_security";
-  constructor(message) {
-    super(message);
-    this.name = "SandboxSecurityError";
-  }
-};
-var SHELL_METACHARACTERS = /[;&|`$(){}]/;
 var SandboxBackend = class {
   config;
   constructor(config = {}) {
@@ -19874,13 +19888,6 @@ var SandboxBackend = class {
     if (result.exitCode !== 0) return [];
     return result.stdout.trim().split("\n").filter(Boolean);
   }
-  validateCommand(command) {
-    if (SHELL_METACHARACTERS.test(command)) {
-      throw new SandboxSecurityError(
-        `Command contains shell metacharacters: ${command.slice(0, 80)}`
-      );
-    }
-  }
   truncateOutput(output) {
     const max = this.config.maxOutputBytes ?? 5 * 1024 * 1024;
     if (Buffer.byteLength(output) > max) {