@theokit/sdk 4.15.0 → 4.15.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 4.15.1
+
+### Patch Changes
+
+- fix(providers): wire `discoverProviderPlugins()` into `Agent.create` — the dynamic provider-plugin loader (and its M47 trust gate) was exported but never invoked on any production path, making the whole discovery surface dead code at runtime. Discovery now runs upfront on agent initialization (idempotent, fail-tolerant), honoring the `resolveProviderChain` contract.
+
 ## 4.15.0
 
 ### Minor Changes

package/dist/cron.cjs

@@ -7148,7 +7148,7 @@ var SkillsManager = class {
   }
   async refresh() {
     const skillsRoot = this.skillsDir ?? path.join(this.cwd, ".theokit", "skills");
-    const discovered = await discoverSkills(skillsRoot, {
+    const discovered2 = await discoverSkills(skillsRoot, {
       onInvalidSkill: (info) => {
         process.stderr.write(
           `[theokit-sdk] skill ${info.name} skipped (${info.code}): ${info.message}
@@ -7156,13 +7156,13 @@ var SkillsManager = class {
         );
       }
     });
-    this.skills = this.mergeInline(discovered);
+    this.skills = this.mergeInline(discovered2);
   }
   /** M22 — merge inline skills over discovered ones; inline wins on a name conflict. */
-  mergeInline(discovered) {
-    if (this.inline === void 0 || this.inline.length === 0) return discovered;
+  mergeInline(discovered2) {
+    if (this.inline === void 0 || this.inline.length === 0) return discovered2;
     const inlineNames = new Set(this.inline.map((s) => s.name));
-    return [...discovered.filter((s) => !inlineNames.has(s.name)), ...this.inline];
+    return [...discovered2.filter((s) => !inlineNames.has(s.name)), ...this.inline];
   }
   list() {
     return Promise.resolve(this.skills);
@@ -8720,7 +8720,7 @@ var FileContextManager = class {
     const legacy = await loadSources(config, this.cwd);
     const maxBytesPerFile = this.settings.maxBytesPerFile ?? DEFAULT_MAX_BYTES_PER_FILE;
     const maxBytesTotal = this.settings.maxBytesTotal ?? DEFAULT_MAX_BYTES_TOTAL;
-    const discovered = await runDiscovery({
+    const discovered2 = await runDiscovery({
       cwd: this.cwd,
       maxBytesPerFile,
       touchedFiles
@@ -8733,7 +8733,7 @@ var FileContextManager = class {
       // matches DEFAULT_DISCOVERY_SPECS theokit-context
       truncated: false
     }));
-    const { kept } = applyAggregateCap([...discovered, ...legacyAsAggregator], maxBytesTotal);
+    const { kept } = applyAggregateCap([...discovered2, ...legacyAsAggregator], maxBytesTotal);
     const loadedSources = kept.map((s) => ({
       name: s.id,
       path: s.source,
@@ -8940,14 +8940,14 @@ var PluginsManager = class {
   // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: MD-first + JSON fallback + both-present detection per plugin folder — branch table is clearer inlined.
   async refresh() {
     this.plugins = [];
-    const pluginsRoot = path.join(this.cwd, ".theokit", "plugins");
-    const entries = await readWorkspaceDir(pluginsRoot, "plugins_read_error", "plugins directory");
+    const pluginsRoot2 = path.join(this.cwd, ".theokit", "plugins");
+    const entries = await readWorkspaceDir(pluginsRoot2, "plugins_read_error", "plugins directory");
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       const folderName = entry.name;
-      const mdPath = path.join(pluginsRoot, folderName, "PLUGIN.md");
-      const jsonPath = path.join(pluginsRoot, folderName, "plugin.json");
-      const metadata = fs.existsSync(mdPath) ? await loadPluginManifestFromMarkdown(pluginsRoot, folderName) : await loadPluginManifestFromJson(jsonPath, folderName);
+      const mdPath = path.join(pluginsRoot2, folderName, "PLUGIN.md");
+      const jsonPath = path.join(pluginsRoot2, folderName, "plugin.json");
+      const metadata = fs.existsSync(mdPath) ? await loadPluginManifestFromMarkdown(pluginsRoot2, folderName) : await loadPluginManifestFromJson(jsonPath, folderName);
       if (fs.existsSync(mdPath) && fs.existsSync(jsonPath)) {
         warnOnce(
           `plugin-${folderName}-both`,
@@ -9026,8 +9026,8 @@ async function loadPluginManifestFromJson(manifestPath, folderName) {
   if (typeof record.entry === "string") metadata.entry = record.entry;
   return metadata;
 }
-async function loadPluginManifestFromMarkdown(pluginsRoot, folderName) {
-  const mdPath = path.join(pluginsRoot, folderName, "PLUGIN.md");
+async function loadPluginManifestFromMarkdown(pluginsRoot2, folderName) {
+  const mdPath = path.join(pluginsRoot2, folderName, "PLUGIN.md");
   let raw;
   try {
     raw = await promises.readFile(mdPath, "utf8");
@@ -9037,7 +9037,7 @@ async function loadPluginManifestFromMarkdown(pluginsRoot, folderName) {
       cause
     });
   }
-  const fakeDir = path.join(pluginsRoot, folderName);
+  const fakeDir = path.join(pluginsRoot2, folderName);
   const entities = await loadMarkdownEntities({
     dir: fakeDir,
     schema: PluginFrontmatterSchema,
@@ -12036,6 +12036,87 @@ function registerBuiltins() {
   registerProvider(CEREBRAS);
   registerCatalogProviders();
 }
+var discovered = false;
+function pluginsRoot() {
+  return path.join(os.homedir(), ".theokit", "plugins", "model-providers");
+}
+function trustFilePath() {
+  return path.join(os.homedir(), ".theokit", "plugins", "trusted-providers.json");
+}
+function loadTrustedNames() {
+  const trusted = /* @__PURE__ */ new Set();
+  const path = trustFilePath();
+  if (fs.existsSync(path)) {
+    try {
+      const parsed = JSON.parse(fs.readFileSync(path, "utf-8"));
+      if (Array.isArray(parsed)) {
+        for (const name of parsed) {
+          if (typeof name === "string" && name.length > 0) trusted.add(name);
+        }
+      } else {
+        process.stderr.write(
+          `[theokit-sdk] WARN: ${path} is not a JSON array \u2014 trusting NO provider plugins (fail-closed)
+`
+        );
+      }
+    } catch {
+      process.stderr.write(
+        `[theokit-sdk] WARN: ${path} is not valid JSON \u2014 trusting NO provider plugins (fail-closed)
+`
+      );
+    }
+  }
+  for (const name of (process.env.THEOKIT_TRUSTED_PROVIDERS ?? "").split(",")) {
+    const trimmed = name.trim();
+    if (trimmed.length > 0) trusted.add(trimmed);
+  }
+  return trusted;
+}
+async function discoverProviderPlugins() {
+  if (discovered) return;
+  discovered = true;
+  const root = pluginsRoot();
+  if (!fs.existsSync(root)) return;
+  let entries;
+  try {
+    entries = await promises.readdir(root);
+  } catch {
+    return;
+  }
+  const trusted = loadTrustedNames();
+  for (const entry of entries) {
+    if (!trusted.has(entry)) {
+      process.stderr.write(
+        `[theokit-sdk] WARN: provider plugin "${entry}" is present but NOT trusted \u2014 skipped. To trust it, add "${entry}" to ${trustFilePath()} (JSON array) or THEOKIT_TRUSTED_PROVIDERS.
+`
+      );
+      continue;
+    }
+    await loadOne(path.join(root, entry), entry);
+  }
+}
+async function loadOne(dir, entryName) {
+  for (const ext of ["index.mjs", "index.js"]) {
+    const indexPath = path.join(dir, ext);
+    if (!fs.existsSync(indexPath)) continue;
+    try {
+      const mod = await import(url.pathToFileURL(indexPath).href);
+      const plugin = mod.default ?? mod[entryName] ?? mod;
+      if (plugin !== null && typeof plugin === "object" && plugin.kind === "model-provider") {
+        const profile = plugin.profile;
+        if (profile !== void 0 && typeof profile === "object") {
+          registerProvider(profile);
+        }
+      }
+      return;
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`[theokit-sdk] failed to load provider plugin "${entryName}": ${msg}
+`);
+      return;
+    }
+  }
+}
 
 // src/internal/llm/anthropic.ts
 init_errors();
@@ -18713,6 +18794,7 @@ var Agent = class _Agent {
       pluginCount: enabledPluginNames(options.plugins).length
     });
     try {
+      await discoverProviderPlugins();
       const agent = await runCreateUnderSpan(options, span);
       return agent;
     } catch (err) {