@theokit/sdk 4.14.0 → 4.15.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 4.15.0
+
+### Minor Changes
+
+- Dynamic provider-plugin trust gate (agent-builder M47): the out-of-tree loader (`~/.theokit/plugins/model-providers/<name>/index.{js,mjs}` — the documented extension path for shipping a provider as a package) now requires EXPLICIT human trust before any dynamic import. A plugin's code executes at import time (an arbitrary-code-execution surface), so nothing is evaluated unless the plugin name is listed in `~/.theokit/plugins/trusted-providers.json` (a JSON string array — the auditable primary) or the additive `THEOKIT_TRUSTED_PROVIDERS` env (comma-separated). Fail-closed: a missing or malformed trust file trusts NOTHING (malformed WARNs); an untrusted plugin is skipped with an actionable WARN naming the file to edit — its code is NEVER evaluated (proven by an import-side-effect fixture test). **BREAKING (deliberate security fix):** previously ANY package dropped into the plugins dir executed unguarded; existing plugin users must add their plugin names to the trust file (the WARN says exactly how).
+
+## 4.14.1
+
+### Patch Changes
+
+- M45 adversarial-review fixes: (H1) a malformed `baseUrl` (scheme-less host, empty env var) no longer throws an untyped `TypeError` from the OpenAIClient CONSTRUCTOR — poisoning the whole provider chain at `resolveProviderChain` time even when only a fallback was misconfigured; the URL parse now degrades to the legacy `/v1/chat/completions` path (byte-identical to pre-M45) and fails typed at fetch time. (M2) re-running `registerBuiltins()` across bundle copies (`@theokit/sdk` + `@theokit/sdk/models`) no longer emits 19 bogus `overridden by user plugin` WARNs — the guard lives on `globalThis` like the registry itself. (M3) a trailing-slash versioned baseUrl (`…/v1/`) now joins cleanly (no `/v1//chat/completions`). (L1) the `google` builtin also honors `GOOGLE_GENERATIVE_AI_API_KEY` (the ai-sdk convention). (L4) `getCatalogCapabilities` resolves entry aliases (e.g. `google`). NOTICE extended for the M45 adaptations. **Migration note (M1):** the chat-completions URL-join now detects version segments ANYWHERE in the baseUrl path — a gateway mounting an OpenAI-compat surface under a versioned prefix (e.g. `https://gw.corp/v2/tenants/x`) that previously got `/v1/chat/completions` appended now gets `/chat/completions`; declare `chatCompletionsPath` on the profile to pin an exact path.
+
 ## 4.14.0
 
 ### Minor Changes

package/dist/cron.cjs

@@ -752,13 +752,13 @@ function setAgentFacade(facade) {
   globalThis[FACADE_KEY] = facade;
 }
 function getAgentFacade() {
-  const registered3 = globalThis[FACADE_KEY];
-  if (registered3 === void 0) {
+  const registered2 = globalThis[FACADE_KEY];
+  if (registered2 === void 0) {
     throw new Error(
       "internal: Agent facade not registered. The `agent.ts` module must be loaded before internal subsystems (LocalAgent.runUntil/fork, eval, scorers, cron) invoke it."
     );
   }
-  return registered3;
+  return registered2;
 }
 var FACADE_KEY;
 var init_agent_factory_registry = __esm({
@@ -11486,11 +11486,22 @@ var DEEPINFRA = openAiCompatibleProfile({
   hostname: "api.deepinfra.com"
 });
 
+// src/internal/providers/builtin/gemini.ts
+var GEMINI = {
+  name: "gemini",
+  apiMode: "chat_completions",
+  envVars: ["OPENROUTER_API_KEY"],
+  authType: "api_key",
+  baseUrl: "https://openrouter.ai/api",
+  hostname: "openrouter.ai",
+  fallbackModels: ["google/gemini-2.0-flash-001"]
+};
+
 // src/internal/providers/builtin/google.ts
 var GOOGLE = openAiCompatibleProfile({
   name: "google",
   baseUrl: "https://generativelanguage.googleapis.com/v1beta/openai",
-  envVars: ["GOOGLE_API_KEY", "GEMINI_API_KEY"],
+  envVars: ["GOOGLE_API_KEY", "GEMINI_API_KEY", "GOOGLE_GENERATIVE_AI_API_KEY"],
   fallbackModels: ["gemini-2.5-pro", "gemini-2.5-flash"],
   hostname: "generativelanguage.googleapis.com"
 });
@@ -11504,56 +11515,6 @@ var GROQ = openAiCompatibleProfile({
   hostname: "api.groq.com"
 });
 
-// src/internal/providers/builtin/mistral.ts
-var MISTRAL = openAiCompatibleProfile({
-  name: "mistral",
-  baseUrl: "https://api.mistral.ai/v1",
-  envVars: ["MISTRAL_API_KEY"],
-  fallbackModels: ["mistral-large-latest", "codestral-latest"],
-  hostname: "api.mistral.ai"
-});
-
-// src/internal/providers/builtin/perplexity.ts
-var PERPLEXITY = openAiCompatibleProfile({
-  name: "perplexity",
-  baseUrl: "https://api.perplexity.ai",
-  chatCompletionsPath: "/chat/completions",
-  envVars: ["PERPLEXITY_API_KEY"],
-  fallbackModels: ["sonar-pro", "sonar"],
-  hostname: "api.perplexity.ai"
-});
-
-// src/internal/providers/builtin/together.ts
-var TOGETHER = openAiCompatibleProfile({
-  name: "together",
-  aliases: ["togetherai"],
-  baseUrl: "https://api.together.xyz/v1",
-  envVars: ["TOGETHER_API_KEY"],
-  fallbackModels: ["Qwen/Qwen2.5-7B-Instruct-Turbo"],
-  hostname: "api.together.xyz"
-});
-
-// src/internal/providers/builtin/xai.ts
-var XAI = openAiCompatibleProfile({
-  name: "xai",
-  aliases: ["grok"],
-  baseUrl: "https://api.x.ai/v1",
-  envVars: ["XAI_API_KEY"],
-  fallbackModels: ["grok-4.5", "grok-4.3"],
-  hostname: "api.x.ai"
-});
-
-// src/internal/providers/builtin/gemini.ts
-var GEMINI = {
-  name: "gemini",
-  apiMode: "chat_completions",
-  envVars: ["OPENROUTER_API_KEY"],
-  authType: "api_key",
-  baseUrl: "https://openrouter.ai/api",
-  hostname: "openrouter.ai",
-  fallbackModels: ["google/gemini-2.0-flash-001"]
-};
-
 // src/internal/providers/builtin/llamacpp.ts
 var LLAMACPP = {
   name: "llamacpp",
@@ -11580,6 +11541,15 @@ var LMSTUDIO = {
   fallbackModels: ["loaded-model"]
 };
 
+// src/internal/providers/builtin/mistral.ts
+var MISTRAL = openAiCompatibleProfile({
+  name: "mistral",
+  baseUrl: "https://api.mistral.ai/v1",
+  envVars: ["MISTRAL_API_KEY"],
+  fallbackModels: ["mistral-large-latest", "codestral-latest"],
+  hostname: "api.mistral.ai"
+});
+
 // src/internal/providers/builtin/ollama.ts
 var OLLAMA = {
   name: "ollama",
@@ -11974,6 +11944,26 @@ var OPENROUTER = {
   extraHeaders: { "HTTP-Referer": "https://usetheo.dev", "X-Title": "theokit" }
 };
 
+// src/internal/providers/builtin/perplexity.ts
+var PERPLEXITY = openAiCompatibleProfile({
+  name: "perplexity",
+  baseUrl: "https://api.perplexity.ai",
+  chatCompletionsPath: "/chat/completions",
+  envVars: ["PERPLEXITY_API_KEY"],
+  fallbackModels: ["sonar-pro", "sonar"],
+  hostname: "api.perplexity.ai"
+});
+
+// src/internal/providers/builtin/together.ts
+var TOGETHER = openAiCompatibleProfile({
+  name: "together",
+  aliases: ["togetherai"],
+  baseUrl: "https://api.together.xyz/v1",
+  envVars: ["TOGETHER_API_KEY"],
+  fallbackModels: ["Qwen/Qwen2.5-7B-Instruct-Turbo"],
+  hostname: "api.together.xyz"
+});
+
 // src/internal/providers/builtin/vertex.ts
 var VERTEX = {
   name: "vertex",
@@ -12005,11 +11995,26 @@ function stripVertexPrefix(modelId) {
   return modelId.replace(/^vertex\/(anthropic|google)\//, "");
 }
 
+// src/internal/providers/builtin/xai.ts
+var XAI = openAiCompatibleProfile({
+  name: "xai",
+  aliases: ["grok"],
+  baseUrl: "https://api.x.ai/v1",
+  envVars: ["XAI_API_KEY"],
+  fallbackModels: ["grok-4.5", "grok-4.3"],
+  hostname: "api.x.ai"
+});
+
 // src/internal/providers/builtin/index.ts
-var registered2 = false;
+var _registeredState = (() => {
+  const g = globalThis;
+  const sym = /* @__PURE__ */ Symbol.for("theokit-sdk.providers.builtins-registered");
+  if (g[sym] === void 0) g[sym] = { done: false };
+  return g[sym];
+})();
 function registerBuiltins() {
-  if (registered2) return;
-  registered2 = true;
+  if (_registeredState.done) return;
+  _registeredState.done = true;
   registerProvider(ANTHROPIC);
   registerProvider(OPENAI);
   registerProvider(OPENAI_CHATGPT);
@@ -13178,11 +13183,18 @@ var StreamSuppressionBuffer = class {
 };
 
 // src/internal/llm/openai.ts
+function deriveChatPath(baseUrl) {
+  try {
+    return /\/v\d+[a-z]*(\/|$)/.test(new URL(baseUrl).pathname) ? "/chat/completions" : "/v1/chat/completions";
+  } catch {
+    return "/v1/chat/completions";
+  }
+}
 var OpenAIClient = class {
   constructor(options) {
     this.options = options;
-    this.baseUrl = options.baseUrl ?? "https://api.openai.com";
-    this.chatPath = options.chatCompletionsPath ?? (/\/v\d+[a-z]*(\/|$)/.test(new URL(this.baseUrl).pathname) ? "/chat/completions" : "/v1/chat/completions");
+    this.baseUrl = (options.baseUrl ?? "https://api.openai.com").replace(/\/+$/, "");
+    this.chatPath = options.chatCompletionsPath ?? deriveChatPath(this.baseUrl);
     this.fetchImpl = options.fetch ?? fetch;
   }
   options;
@@ -14652,12 +14664,12 @@ function resolveMcpCwd(configCwd) {
 
 // src/internal/providers/register-plugin-providers.ts
 function registerPluginProviderProfiles(entries) {
-  let registered3 = 0;
+  let registered2 = 0;
   for (const entry of entries) {
     registerProvider(entry.profile);
-    registered3 += 1;
+    registered2 += 1;
   }
-  return registered3;
+  return registered2;
 }
 
 // src/internal/local-agent/real-local-run.ts
@@ -14982,12 +14994,12 @@ var pluginProvidersAnnounced = false;
 function resolveRunProvider(options) {
   registerBuiltins();
   const profiles = options.pluginManager?.aggregated.providerProfiles ?? [];
-  const registered3 = registerPluginProviderProfiles(profiles);
-  if (registered3 > 0 && !pluginProvidersAnnounced) {
+  const registered2 = registerPluginProviderProfiles(profiles);
+  if (registered2 > 0 && !pluginProvidersAnnounced) {
     pluginProvidersAnnounced = true;
     const names = profiles.map((e) => e.profile.name).join(", ");
     process.stderr.write(
-      `[theokit-sdk] registered ${registered3} plugin provider profile(s): ${names}
+      `[theokit-sdk] registered ${registered2} plugin provider profile(s): ${names}
 `
     );
   }