@theokit/sdk 4.15.0 → 4.15.1

package/dist/index.cjs

@@ -9726,7 +9726,7 @@ var SkillsManager = class {
   }
   async refresh() {
     const skillsRoot = this.skillsDir ?? path.join(this.cwd, ".theokit", "skills");
-    const discovered = await discoverSkills(skillsRoot, {
+    const discovered2 = await discoverSkills(skillsRoot, {
       onInvalidSkill: (info) => {
         process.stderr.write(
           `[theokit-sdk] skill ${info.name} skipped (${info.code}): ${info.message}
@@ -9734,13 +9734,13 @@ var SkillsManager = class {
         );
       }
     });
-    this.skills = this.mergeInline(discovered);
+    this.skills = this.mergeInline(discovered2);
   }
   /** M22 — merge inline skills over discovered ones; inline wins on a name conflict. */
-  mergeInline(discovered) {
-    if (this.inline === void 0 || this.inline.length === 0) return discovered;
+  mergeInline(discovered2) {
+    if (this.inline === void 0 || this.inline.length === 0) return discovered2;
     const inlineNames = new Set(this.inline.map((s) => s.name));
-    return [...discovered.filter((s) => !inlineNames.has(s.name)), ...this.inline];
+    return [...discovered2.filter((s) => !inlineNames.has(s.name)), ...this.inline];
   }
   list() {
     return Promise.resolve(this.skills);
@@ -11301,7 +11301,7 @@ var FileContextManager = class {
     const legacy = await loadSources(config, this.cwd);
     const maxBytesPerFile = this.settings.maxBytesPerFile ?? DEFAULT_MAX_BYTES_PER_FILE;
     const maxBytesTotal = this.settings.maxBytesTotal ?? DEFAULT_MAX_BYTES_TOTAL;
-    const discovered = await runDiscovery({
+    const discovered2 = await runDiscovery({
       cwd: this.cwd,
       maxBytesPerFile,
       touchedFiles
@@ -11314,7 +11314,7 @@ var FileContextManager = class {
       // matches DEFAULT_DISCOVERY_SPECS theokit-context
       truncated: false
     }));
-    const { kept } = applyAggregateCap([...discovered, ...legacyAsAggregator], maxBytesTotal);
+    const { kept } = applyAggregateCap([...discovered2, ...legacyAsAggregator], maxBytesTotal);
     const loadedSources = kept.map((s) => ({
       name: s.id,
       path: s.source,
@@ -11522,14 +11522,14 @@ var PluginsManager = class {
   // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: MD-first + JSON fallback + both-present detection per plugin folder — branch table is clearer inlined.
   async refresh() {
     this.plugins = [];
-    const pluginsRoot = path.join(this.cwd, ".theokit", "plugins");
-    const entries = await readWorkspaceDir(pluginsRoot, "plugins_read_error", "plugins directory");
+    const pluginsRoot2 = path.join(this.cwd, ".theokit", "plugins");
+    const entries = await readWorkspaceDir(pluginsRoot2, "plugins_read_error", "plugins directory");
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       const folderName = entry.name;
-      const mdPath = path.join(pluginsRoot, folderName, "PLUGIN.md");
-      const jsonPath = path.join(pluginsRoot, folderName, "plugin.json");
-      const metadata = fs.existsSync(mdPath) ? await loadPluginManifestFromMarkdown(pluginsRoot, folderName) : await loadPluginManifestFromJson(jsonPath, folderName);
+      const mdPath = path.join(pluginsRoot2, folderName, "PLUGIN.md");
+      const jsonPath = path.join(pluginsRoot2, folderName, "plugin.json");
+      const metadata = fs.existsSync(mdPath) ? await loadPluginManifestFromMarkdown(pluginsRoot2, folderName) : await loadPluginManifestFromJson(jsonPath, folderName);
       if (fs.existsSync(mdPath) && fs.existsSync(jsonPath)) {
         warnOnce(
           `plugin-${folderName}-both`,
@@ -11608,8 +11608,8 @@ async function loadPluginManifestFromJson(manifestPath, folderName) {
   if (typeof record.entry === "string") metadata.entry = record.entry;
   return metadata;
 }
-async function loadPluginManifestFromMarkdown(pluginsRoot, folderName) {
-  const mdPath = path.join(pluginsRoot, folderName, "PLUGIN.md");
+async function loadPluginManifestFromMarkdown(pluginsRoot2, folderName) {
+  const mdPath = path.join(pluginsRoot2, folderName, "PLUGIN.md");
   let raw;
   try {
     raw = await promises.readFile(mdPath, "utf8");
@@ -11619,7 +11619,7 @@ async function loadPluginManifestFromMarkdown(pluginsRoot, folderName) {
       cause
     });
   }
-  const fakeDir = path.join(pluginsRoot, folderName);
+  const fakeDir = path.join(pluginsRoot2, folderName);
   const entities = await loadMarkdownEntities({
     dir: fakeDir,
     schema: PluginFrontmatterSchema,
@@ -14635,6 +14635,87 @@ function registerBuiltins() {
   registerProvider(CEREBRAS);
   registerCatalogProviders();
 }
+var discovered = false;
+function pluginsRoot() {
+  return path.join(os.homedir(), ".theokit", "plugins", "model-providers");
+}
+function trustFilePath() {
+  return path.join(os.homedir(), ".theokit", "plugins", "trusted-providers.json");
+}
+function loadTrustedNames() {
+  const trusted = /* @__PURE__ */ new Set();
+  const path = trustFilePath();
+  if (fs.existsSync(path)) {
+    try {
+      const parsed = JSON.parse(fs.readFileSync(path, "utf-8"));
+      if (Array.isArray(parsed)) {
+        for (const name of parsed) {
+          if (typeof name === "string" && name.length > 0) trusted.add(name);
+        }
+      } else {
+        process.stderr.write(
+          `[theokit-sdk] WARN: ${path} is not a JSON array \u2014 trusting NO provider plugins (fail-closed)
+`
+        );
+      }
+    } catch {
+      process.stderr.write(
+        `[theokit-sdk] WARN: ${path} is not valid JSON \u2014 trusting NO provider plugins (fail-closed)
+`
+      );
+    }
+  }
+  for (const name of (process.env.THEOKIT_TRUSTED_PROVIDERS ?? "").split(",")) {
+    const trimmed = name.trim();
+    if (trimmed.length > 0) trusted.add(trimmed);
+  }
+  return trusted;
+}
+async function discoverProviderPlugins() {
+  if (discovered) return;
+  discovered = true;
+  const root = pluginsRoot();
+  if (!fs.existsSync(root)) return;
+  let entries;
+  try {
+    entries = await promises.readdir(root);
+  } catch {
+    return;
+  }
+  const trusted = loadTrustedNames();
+  for (const entry of entries) {
+    if (!trusted.has(entry)) {
+      process.stderr.write(
+        `[theokit-sdk] WARN: provider plugin "${entry}" is present but NOT trusted \u2014 skipped. To trust it, add "${entry}" to ${trustFilePath()} (JSON array) or THEOKIT_TRUSTED_PROVIDERS.
+`
+      );
+      continue;
+    }
+    await loadOne(path.join(root, entry), entry);
+  }
+}
+async function loadOne(dir, entryName) {
+  for (const ext of ["index.mjs", "index.js"]) {
+    const indexPath = path.join(dir, ext);
+    if (!fs.existsSync(indexPath)) continue;
+    try {
+      const mod = await import(url.pathToFileURL(indexPath).href);
+      const plugin = mod.default ?? mod[entryName] ?? mod;
+      if (plugin !== null && typeof plugin === "object" && plugin.kind === "model-provider") {
+        const profile = plugin.profile;
+        if (profile !== void 0 && typeof profile === "object") {
+          registerProvider(profile);
+        }
+      }
+      return;
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`[theokit-sdk] failed to load provider plugin "${entryName}": ${msg}
+`);
+      return;
+    }
+  }
+}
 
 // src/internal/llm/anthropic.ts
 init_errors();
@@ -20366,6 +20447,7 @@ var Agent = class _Agent {
       pluginCount: enabledPluginNames(options.plugins).length
     });
     try {
+      await discoverProviderPlugins();
       const agent = await runCreateUnderSpan(options, span);
       return agent;
     } catch (err) {