@theokit/sdk 3.2.0 → 3.2.3

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## 3.2.3
+
+### Patch Changes
+
+- 1770aec: Fix (#59) — a stdio MCP client no longer permanently wedges after a transient outage exceeds the reconnect attempt bound. The bound is now LOCAL to each reconnect cycle (a bounded retry loop with backoff), so a later request re-arms a fresh cycle and reconnects once the server recovers — while a genuinely-broken server still surfaces a typed `mcp_disconnected` "reconnect exhausted". Adds the previously-missing HTTP-transport recovery test (stateless reconnect on the next request after a transport failure).
+- cda0542: Fix (#60) — `Retry-After` now also parses the RFC-7231 HTTP-date form (`Retry-After: Wed, 21 Oct 2025 07:28:00 GMT`), converting it to seconds-until-then (clamped at 0 for a past date). Previously only the numeric-seconds form was honored; a date-form header was silently dropped. Clarified that the same-key 429 retry deliberately does not block on `Retry-After` (a multi-key pool rotates to a fresh key immediately; the cooldown is honored at pool-selection level).
+- 510041b: Fix (#61) — the Anthropic streaming client now detects a truncated stream. A stream that closes cleanly-but-early (server FIN / proxy hiccup before the terminal `message_delta` carrying `stop_reason`) previously committed silently as a clean `end_turn`; it now throws a typed `NetworkError{code:"stream_truncated"}`, matching the OpenAI client's guard.
+- f7d39c8: Fix (#63) — pagination now fails fast on invalid cursors. `paginate({ offset, limit })` rejected a `NaN` offset by silently returning the WHOLE list (and negative by returning empty); it now throws `ConfigurationError{code:"pagination_invalid"}` for any non-negative-integer offset/limit. Also adds real cross-process evidence for the conversation-storage file lock: two separate OS processes taking `withFileLock` on the same file are proven to serialize (previously only in-process concurrency was tested).
+
+## 3.2.2
+
+### Patch Changes
+
+- 7f57c5a: Security (#55) — a delegated subagent now inherits the parent's code-registered plugins (e.g. `PermissionPlugin`), so its inner tool calls run under the SAME argument-level permission gate. Previously the child `Agent.create` received only apiKey/model/tools, so a parent that denied `shell` with a matching-arg rule did not stop a subagent it granted `shell` to — arg-level gating silently stopped at the delegation boundary.
+- f81ac79: Fix (#58) — a run cancelled between tool iterations now reports `RunStatus: "cancelled"` instead of `"finished"`, so a caller can distinguish a cancellation from a clean completion. Previously the between-iteration abort break left the default `"finished"` status.
+- 57cfcc8: Fix (#58) — `JobQueue.cancel()` on a running job that ignores its `AbortSignal` (never settles) previously leaked its concurrency slot, deadlocking a `maxConcurrency`-bounded queue. Cancel now frees the slot immediately; `#release` is idempotent so the job's eventual settle is a no-op (no double-free).
+- bd06140: Fix (#65) — the `transform_llm_output` plugin hook now rewrites the FINAL user-visible / streamed assistant text, and fires on text-only terminal turns. Previously it ran only in the tool-call branch and folded only into internal message history, so a plugin could not scrub what the caller actually received. The transform is now applied once, up front, and flows into the emitted step, `finalText`/`result`, and message history alike.
+
+## 3.2.1
+
+### Patch Changes
+
+- a283dd4: Security (#54) — harden child-process env scrubbing.
+
+  - The `inherit-scrubbed` denylist now also drops the highest-signal VALUE-embedded-secret conventions: connection strings that carry `user:password@` (`DATABASE_URL`, `REDIS_URL`, `MONGODB_URI`, `DB_URL`, …), plus `DSN`, `WEBHOOK`, `COOKIE`, and `CONNECTION_STRING`. Generic non-secret URLs (`PUBLIC_BASE_URL`, `API_URL`, `PGHOST`) are deliberately preserved. A denylist still cannot catch every value-embedded secret — policy `core` (allowlist) remains the fail-closed mode for untrusted children.
+  - Removed dead `validateCommand` / `SHELL_METACHARACTERS` from the sandbox base — a never-invoked "guard" that provided a false sense of protection.
+  - Added an end-to-end test proving `LocalSandbox.execute` scrubs secret-like host env vars from the real child process.
+
+- 826bca0: Security (#56) — close two residual cross-tenant active-recall cache leaks found by adversarial review.
+
+  - `@theokit/sdk-memory` (publishable) called `cache.get`/`cache.set` with no tenant context, so two callers with the same query text but different identity shared a cached recall — a cross-tenant leak for every consumer of the package. The cache read/write are now keyed by the `{namespace, userId, scope}` tenant tuple (the primitive already supported it).
+  - In `@theokit/sdk` the production caller hardcoded `namespace: "default"` and dropped `memoryContext.tenantId`, so two tenants sharing a `userId` collided on one cache entry. The caller now threads `memoryContext.tenantId` into the tenant partition (`namespace`). `sessionId` is intentionally not a key dimension — recall is cross-session by design.
+
+- 7bcc872: Security/correctness (#59) — the HTTP MCP body read (`response.json()`) was outside the abort try/catch, so a server that returned headers then stalled the body surfaced a raw `DOMException(TimeoutError)` instead of the typed `NetworkError{code:"mcp_timeout"}`. The request was still bounded (no hang), but the typed-timeout contract now holds across both the header and body phases.
+
 ## 3.2.0
 
 ### Minor Changes

package/dist/a2a/index.cjs

@@ -4743,7 +4743,14 @@ var init_env_policy = __esm({
       /[_-]PWD/i,
       /CREDENTIAL/i,
       /PRIVATE/i,
-      /_AUTH/i
+      /_AUTH/i,
+      // #54-a — value-embedded-secret conventions (no generic `*_URL` — see keep-list test).
+      /DSN/i,
+      /WEBHOOK/i,
+      /COOKIE/i,
+      /CONNECTION[_-]?STRING/i,
+      // Known DB / message-broker connection-string vars (carry `user:pass@`).
+      /(?:^|[_-])(?:DATABASE|DB|REDIS|MONGO(?:DB)?|POSTGRES(?:QL)?|MYSQL|MARIADB|AMQP|RABBITMQ|CLICKHOUSE|ELASTIC(?:SEARCH)?|CASSANDRA|COUCHDB|MEMCACHED|NATS|KAFKA)[_-]?(?:URL|URI|DSN|CONNECTION)/i
     ];
     CORE_VARS = [
       "PATH",
@@ -5152,12 +5159,23 @@ var init_objective_coerce = __esm({
 // src/internal/persistence/pagination.ts
 function paginate(items, opts) {
   if (opts === void 0 || opts.offset === void 0 && opts.limit === void 0) return items;
-  const start = Math.max(0, opts.offset ?? 0);
-  const end = opts.limit === void 0 ? items.length : start + Math.max(0, opts.limit);
+  const start = opts.offset === void 0 ? 0 : requireNonNegativeInt(opts.offset, "offset");
+  const limit = opts.limit === void 0 ? void 0 : requireNonNegativeInt(opts.limit, "limit");
+  const end = limit === void 0 ? items.length : start + limit;
   return items.slice(start, end);
 }
+function requireNonNegativeInt(value, field) {
+  if (!Number.isInteger(value) || value < 0) {
+    throw new ConfigurationError(
+      `Invalid pagination ${field}: expected a non-negative integer, got ${value}`,
+      { code: "pagination_invalid" }
+    );
+  }
+  return value;
+}
 var init_pagination = __esm({
   "src/internal/persistence/pagination.ts"() {
+    init_errors();
   }
 });
 
@@ -9498,7 +9516,10 @@ async function runAgentLoop(inputs) {
       }
       budget.consume();
       inputs.budgetTracker?.nextIteration?.();
-      if (inputs.signal?.aborted === true) break;
+      if (inputs.signal?.aborted === true) {
+        ctx.finalStatus = "cancelled";
+        break;
+      }
     }
     if (lastTurnDecision === "continue" && budget.shouldContinue() === false) {
       ctx.stoppedAtIterationLimit = true;
@@ -9683,15 +9704,15 @@ async function guardAndTransformToolResults(inputs, raw, ctx) {
 }
 async function continueOrTerminate(inputs, ctx, llmOutput) {
   if (llmOutput.errored) return "error";
-  if (llmOutput.text.length > 0) {
-    await emitAssistantTextStep(inputs, ctx, llmOutput.text);
+  const tCtx = { agentId: inputs.agentId, runId: inputs.runId };
+  const text = llmOutput.text.length > 0 ? await transformLlmOutputText(inputs, llmOutput.text, tCtx) : llmOutput.text;
+  if (text.length > 0) {
+    await emitAssistantTextStep(inputs, ctx, text);
   }
   if (llmOutput.stopReason !== "tool_use" || llmOutput.toolCalls.length === 0) {
     return finishOrReflect(inputs, ctx, llmOutput);
   }
-  const tCtx = { agentId: inputs.agentId, runId: inputs.runId };
-  const outText = await transformLlmOutputText(inputs, llmOutput.text, tCtx);
-  ctx.messages.push(buildAssistantTurn(outText, llmOutput.toolCalls));
+  ctx.messages.push(buildAssistantTurn(text, llmOutput.toolCalls));
   const rawResults = await dispatchTools(
     // SE12 — forward a read-only text projection of the transcript-so-far to tool
     // handlers via `ctx.messages` (consumed by defineSubAgent's messageFilter).
@@ -10155,6 +10176,8 @@ function parseRetryAfter(headers) {
   if (raw === null) return void 0;
   const n = Number(raw);
   if (Number.isFinite(n) && n >= 0) return Math.ceil(n);
+  const dateMs = Date.parse(raw);
+  if (Number.isFinite(dateMs)) return Math.max(0, Math.ceil((dateMs - Date.now()) / 1e3));
   return void 0;
 }
 function truncateRaw(body) {
@@ -10475,6 +10498,7 @@ function buildAnthropicBody(request) {
 var AnthropicClient, AnthropicStreamAccumulator;
 var init_anthropic3 = __esm({
   "src/internal/llm/anthropic.ts"() {
+    init_errors();
     init_anthropic2();
     init_anthropic_shared();
     init_finish();
@@ -10528,12 +10552,23 @@ var init_anthropic3 = __esm({
           const events = accumulator.consume(parsed);
           for (const event of events) yield event;
         }
+        if (!accumulator.finishReasonSeen) {
+          throw new NetworkError("Anthropic SSE stream truncated (no stop_reason)", {
+            code: "stream_truncated"
+          });
+        }
         return accumulator.finish();
       }
     };
     AnthropicStreamAccumulator = class {
       text = "";
       stopReason = "end_turn";
+      /**
+       * M2 #61 — whether a `message_delta` carrying a real `stop_reason` was seen.
+       * A stream that closes before it is a truncation (server FIN / proxy hiccup),
+       * not a clean `end_turn` — the caller throws `stream_truncated` on `false`.
+       */
+      sawStopReason = false;
       inputTokens;
       outputTokens;
       cacheReadTokens;
@@ -10580,6 +10615,9 @@ var init_anthropic3 = __esm({
        * spinning the SSE parser.
        */
       handleMessageDelta(md) {
+        if (md.delta.stop_reason !== void 0 && md.delta.stop_reason !== null) {
+          this.sawStopReason = true;
+        }
         this.stopReason = mapAnthropicStopReason(md.delta.stop_reason);
         if (md.usage?.input_tokens !== void 0) this.inputTokens = md.usage.input_tokens;
         if (md.usage?.output_tokens !== void 0) this.outputTokens = md.usage.output_tokens;
@@ -10590,6 +10628,10 @@ var init_anthropic3 = __esm({
           this.cacheReadTokens = md.usage.cache_read_input_tokens;
         }
       }
+      /** M2 #61 — whether the terminal `message_delta` (stop_reason) was seen. */
+      get finishReasonSeen() {
+        return this.sawStopReason;
+      }
       finish() {
         const toolCalls = [];
         for (const [index, tool] of this.toolCalls.entries()) {
@@ -12823,7 +12865,6 @@ var init_client = __esm({
       // concurrent request so parallel tool dispatch after a drop awaits one handshake
       // instead of racing (or spuriously failing with mcp_not_init).
       dropped = false;
-      reconnectAttempts = 0;
       reconnectPromise;
       get timeoutMs() {
         return this.config.requestTimeoutMs ?? DEFAULT_MCP_TIMEOUT_MS;
@@ -12876,15 +12917,22 @@ var init_client = __esm({
         return this.reconnectPromise;
       }
       async reconnect() {
-        if (this.reconnectAttempts >= MAX_RECONNECT_ATTEMPTS) {
-          throw new NetworkError(`MCP ${this.name} reconnect exhausted`, { code: "mcp_disconnected" });
+        let lastErr;
+        for (let attempt = 0; attempt < MAX_RECONNECT_ATTEMPTS; attempt += 1) {
+          await reconnectDelay(attempt);
+          this.spawnChild();
+          try {
+            await super.initialize();
+            this.dropped = false;
+            return;
+          } catch (err) {
+            lastErr = err;
+          }
         }
-        await reconnectDelay(this.reconnectAttempts);
-        this.reconnectAttempts += 1;
-        this.spawnChild();
-        await super.initialize();
-        this.dropped = false;
-        this.reconnectAttempts = 0;
+        throw new NetworkError(`MCP ${this.name} reconnect exhausted`, {
+          code: "mcp_disconnected",
+          ...lastErr instanceof Error ? { cause: lastErr } : {}
+        });
       }
       async close() {
         this.rejectAllPending(new NetworkError(`MCP ${this.name} closed`, { code: "mcp_closed" }));
@@ -13015,7 +13063,12 @@ var init_client = __esm({
             code: "mcp_http_error"
           });
         }
-        return await response.json();
+        try {
+          return await response.json();
+        } catch (cause) {
+          if (isAbortLike(cause)) throw mcpTimeoutError(this.name, timeoutMs);
+          throw cause;
+        }
       }
     };
   }
@@ -13255,9 +13308,11 @@ function declarativeSubagentTools(agentOptions, parentTools) {
   return subAgentToolsFromDefinitions(agents2, parentTools);
 }
 function bindParentCredentials(tools, agentOptions) {
+  const parentPlugins = Array.isArray(agentOptions.plugins) ? agentOptions.plugins : void 0;
   const credentials = {
     ...agentOptions.apiKey !== void 0 ? { apiKey: agentOptions.apiKey } : {},
-    ...typeof agentOptions.model === "object" ? { model: agentOptions.model } : {}
+    ...typeof agentOptions.model === "object" ? { model: agentOptions.model } : {},
+    ...parentPlugins !== void 0 ? { plugins: parentPlugins } : {}
   };
   for (const tool of tools) inheritSubAgentCredentials(tool, credentials);
 }
@@ -15782,10 +15837,11 @@ var init_local_agent_memory = __esm({
       }
       buildTelemetryRecallArgs(telemetry) {
         const userId = typeof this.options.memoryContext?.userId === "string" ? this.options.memoryContext.userId : void 0;
+        const tenantId = typeof this.options.memoryContext?.tenantId === "string" ? this.options.memoryContext.tenantId : void 0;
         return {
           ...telemetry !== void 0 ? { telemetry } : {},
           ...userId !== void 0 ? { userId } : {},
-          namespace: "default",
+          namespace: tenantId ?? "default",
           scope: "session"
         };
       }
@@ -19119,15 +19175,19 @@ async function collectChildToolResults(run) {
 ${lines.join("\n")}
 </subagent-tool-results>`;
 }
-async function runChildAgent(spec, input, signal, maxSteps, inherited) {
-  const { Agent: Agent2 } = await Promise.resolve().then(() => (init_agent(), agent_exports));
+function buildChildCreateOptions(spec, inherited) {
   const model = spec.model ? { id: spec.model } : inherited?.model;
-  const agent = await Agent2.create({
+  return {
     ...inherited?.apiKey !== void 0 ? { apiKey: inherited.apiKey } : {},
     ...model !== void 0 ? { model } : {},
+    ...inherited?.plugins !== void 0 ? { plugins: inherited.plugins } : {},
     systemPrompt: spec.instructions,
     tools: spec.tools ?? []
-  });
+  };
+}
+async function runChildAgent(spec, input, signal, maxSteps, inherited) {
+  const { Agent: Agent2 } = await Promise.resolve().then(() => (init_agent(), agent_exports));
+  const agent = await Agent2.create(buildChildCreateOptions(spec, inherited));
   try {
     const sendOptions = {
       ...signal !== void 0 ? { signal } : {},