@theokit/sdk 4.15.0 → 4.15.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 4.15.2
+
+### Patch Changes
+
+- fix(providers): M47 adversarial-review fixes on the dynamic-loader trust gate — (F1) `Agent.resume` now runs provider-plugin discovery (a fresh process resuming a persisted agent whose model targets a plugin provider no longer fails resolution); (F2) `Theokit.models.list({provider})` local path runs discovery too (sync surfaces stay builtins-only, documented); (F3) the discovery idempotence flag moved to `globalThis` (`Symbol.for`) matching the registry's M44 B1 pattern — no duplicate discovery per bundle entry; (F4/F7) the NOT-trusted WARN now says "then restart the process" and documents the comma-separated env format; (F5) non-string entries in a valid trust-file array WARN instead of being silently discarded.
+
+## 4.15.1
+
+### Patch Changes
+
+- fix(providers): wire `discoverProviderPlugins()` into `Agent.create` — the dynamic provider-plugin loader (and its M47 trust gate) was exported but never invoked on any production path, making the whole discovery surface dead code at runtime. Discovery now runs upfront on agent initialization (idempotent, fail-tolerant), honoring the `resolveProviderChain` contract.
+
 ## 4.15.0
 
 ### Minor Changes

package/dist/cron.cjs

@@ -8940,14 +8940,14 @@ var PluginsManager = class {
   // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: MD-first + JSON fallback + both-present detection per plugin folder — branch table is clearer inlined.
   async refresh() {
     this.plugins = [];
-    const pluginsRoot = path.join(this.cwd, ".theokit", "plugins");
-    const entries = await readWorkspaceDir(pluginsRoot, "plugins_read_error", "plugins directory");
+    const pluginsRoot2 = path.join(this.cwd, ".theokit", "plugins");
+    const entries = await readWorkspaceDir(pluginsRoot2, "plugins_read_error", "plugins directory");
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       const folderName = entry.name;
-      const mdPath = path.join(pluginsRoot, folderName, "PLUGIN.md");
-      const jsonPath = path.join(pluginsRoot, folderName, "plugin.json");
-      const metadata = fs.existsSync(mdPath) ? await loadPluginManifestFromMarkdown(pluginsRoot, folderName) : await loadPluginManifestFromJson(jsonPath, folderName);
+      const mdPath = path.join(pluginsRoot2, folderName, "PLUGIN.md");
+      const jsonPath = path.join(pluginsRoot2, folderName, "plugin.json");
+      const metadata = fs.existsSync(mdPath) ? await loadPluginManifestFromMarkdown(pluginsRoot2, folderName) : await loadPluginManifestFromJson(jsonPath, folderName);
       if (fs.existsSync(mdPath) && fs.existsSync(jsonPath)) {
         warnOnce(
           `plugin-${folderName}-both`,
@@ -9026,8 +9026,8 @@ async function loadPluginManifestFromJson(manifestPath, folderName) {
   if (typeof record.entry === "string") metadata.entry = record.entry;
   return metadata;
 }
-async function loadPluginManifestFromMarkdown(pluginsRoot, folderName) {
-  const mdPath = path.join(pluginsRoot, folderName, "PLUGIN.md");
+async function loadPluginManifestFromMarkdown(pluginsRoot2, folderName) {
+  const mdPath = path.join(pluginsRoot2, folderName, "PLUGIN.md");
   let raw;
   try {
     raw = await promises.readFile(mdPath, "utf8");
@@ -9037,7 +9037,7 @@ async function loadPluginManifestFromMarkdown(pluginsRoot, folderName) {
       cause
     });
   }
-  const fakeDir = path.join(pluginsRoot, folderName);
+  const fakeDir = path.join(pluginsRoot2, folderName);
   const entities = await loadMarkdownEntities({
     dir: fakeDir,
     schema: PluginFrontmatterSchema,
@@ -12036,6 +12036,103 @@ function registerBuiltins() {
   registerProvider(CEREBRAS);
   registerCatalogProviders();
 }
+function globalSingleton3(key, create) {
+  const g = globalThis;
+  const sym = Symbol.for(key);
+  if (g[sym] === void 0) g[sym] = create();
+  return g[sym];
+}
+var discoveryState = globalSingleton3("theokit-sdk.providers.discovered", () => ({
+  done: false
+}));
+function pluginsRoot() {
+  return path.join(os.homedir(), ".theokit", "plugins", "model-providers");
+}
+function trustFilePath() {
+  return path.join(os.homedir(), ".theokit", "plugins", "trusted-providers.json");
+}
+function loadTrustedNames() {
+  const trusted = /* @__PURE__ */ new Set();
+  const path = trustFilePath();
+  if (fs.existsSync(path)) {
+    try {
+      const parsed = JSON.parse(fs.readFileSync(path, "utf-8"));
+      if (Array.isArray(parsed)) {
+        let discarded = 0;
+        for (const name of parsed) {
+          if (typeof name === "string" && name.length > 0) trusted.add(name);
+          else discarded += 1;
+        }
+        if (discarded > 0) {
+          process.stderr.write(
+            `[theokit-sdk] WARN: ${path} contains ${discarded} non-string entr${discarded === 1 ? "y" : "ies"} \u2014 discarded (entries must be plugin-name strings)
+`
+          );
+        }
+      } else {
+        process.stderr.write(
+          `[theokit-sdk] WARN: ${path} is not a JSON array \u2014 trusting NO provider plugins (fail-closed)
+`
+        );
+      }
+    } catch {
+      process.stderr.write(
+        `[theokit-sdk] WARN: ${path} is not valid JSON \u2014 trusting NO provider plugins (fail-closed)
+`
+      );
+    }
+  }
+  for (const name of (process.env.THEOKIT_TRUSTED_PROVIDERS ?? "").split(",")) {
+    const trimmed = name.trim();
+    if (trimmed.length > 0) trusted.add(trimmed);
+  }
+  return trusted;
+}
+async function discoverProviderPlugins() {
+  if (discoveryState.done) return;
+  discoveryState.done = true;
+  const root = pluginsRoot();
+  if (!fs.existsSync(root)) return;
+  let entries;
+  try {
+    entries = await promises.readdir(root);
+  } catch {
+    return;
+  }
+  const trusted = loadTrustedNames();
+  for (const entry of entries) {
+    if (!trusted.has(entry)) {
+      process.stderr.write(
+        `[theokit-sdk] WARN: provider plugin "${entry}" is present but NOT trusted \u2014 skipped. To trust it, add "${entry}" to ${trustFilePath()} (JSON array of names) or THEOKIT_TRUSTED_PROVIDERS (comma-separated), then restart the process.
+`
+      );
+      continue;
+    }
+    await loadOne(path.join(root, entry), entry);
+  }
+}
+async function loadOne(dir, entryName) {
+  for (const ext of ["index.mjs", "index.js"]) {
+    const indexPath = path.join(dir, ext);
+    if (!fs.existsSync(indexPath)) continue;
+    try {
+      const mod = await import(url.pathToFileURL(indexPath).href);
+      const plugin = mod.default ?? mod[entryName] ?? mod;
+      if (plugin !== null && typeof plugin === "object" && plugin.kind === "model-provider") {
+        const profile = plugin.profile;
+        if (profile !== void 0 && typeof profile === "object") {
+          registerProvider(profile);
+        }
+      }
+      return;
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`[theokit-sdk] failed to load provider plugin "${entryName}": ${msg}
+`);
+      return;
+    }
+  }
+}
 
 // src/internal/llm/anthropic.ts
 init_errors();
@@ -18584,6 +18681,7 @@ function resolveAgentPersistenceCwd(options) {
   return process.cwd();
 }
 async function rehydrateExistingAgent(agentId, existing, options) {
+  await discoverProviderPlugins();
   await validateRehydratedAgent(agentId, existing);
   const mergedLocal = options.local !== void 0 && existing.options.local !== void 0 ? { ...existing.options.local, ...options.local } : options.local ?? existing.options.local;
   const mergedOptions = {
@@ -18713,6 +18811,7 @@ var Agent = class _Agent {
       pluginCount: enabledPluginNames(options.plugins).length
     });
     try {
+      await discoverProviderPlugins();
       const agent = await runCreateUnderSpan(options, span);
       return agent;
     } catch (err) {